Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 20:10
Behavioral task
behavioral1
Sample
0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe
- Size 873KB
- Sample260728-yxtjfawybw
- SHA256 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f
- MD5 94662f3213b246fa61512171d6da4334
- SHA1 456ded957efc9be0f0cf33eb21d2017a30f4e417
- SHA512 c2624fb252b618defe70d8dd88151c667375ee30e7b60974cf220ceab0ec6ade33848acc49c81e0793f1d46d44e44eba222055eff701beb392bcd568213e0167
- SSDEEP 12288:JSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3uEW:wvO2xJKRw2kOkx2LFRvcUQPxW
- TLSH T1A4156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2956 ad5456b3 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe Destination IP 5 223.5.5.5 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe Destination IP 18 114.114.114.114 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe Destination IP 19 223.5.5.5 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ad5456b3 File created C:\Windows\SysWOW64\ad5456b3 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ad5456b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ad5456b3 -
resource yara_rule behavioral2/memory/3452-0-0x00000000009F0000-0x0000000000A7C000-memory.dmp upx behavioral2/files/0x000d000000016cdc-2.dat upx behavioral2/memory/2956-3-0x0000000000C60000-0x0000000000CEC000-memory.dmp upx behavioral2/memory/3452-16-0x00000000009F0000-0x0000000000A7C000-memory.dmp upx behavioral2/memory/2956-17-0x0000000000C60000-0x0000000000CEC000-memory.dmp upx behavioral2/memory/2956-31-0x0000000000C60000-0x0000000000CEC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\329b98 ad5456b3 File opened for modification C:\Windows\3b1978 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad5456b3 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ad5456b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ad5456b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ad5456b3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ad5456b3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ad5456b3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ad5456b3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ad5456b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ad5456b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ad5456b3 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2956 ad5456b3 2956 ad5456b3 2956 ad5456b3 2956 ad5456b3 2956 ad5456b3 2956 ad5456b3 2956 ad5456b3 2956 ad5456b3 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe Token: SeTcbPrivilege 3452 0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe Token: SeDebugPrivilege 2956 ad5456b3 Token: SeTcbPrivilege 2956 ad5456b3
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe"C:\Users\Admin\AppData\Local\Temp\0e3d67d4e364372a62fe47ae302919b2c4276594ff16614ba6814202c3e6978f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
C:\Windows\Syswow64\ad5456b3C:\Windows\Syswow64\ad5456b31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ad5456b3
- Size 873KB
- SHA256 a6f140c13ac56f80c6d002b14589d573c04811ca88b7b46cde641f3a5234bc14
- MD5 afd18fef79795a9287fb93ee2e5e2bc1
- SHA1 7367b9452b1680d027615a1bd193a30e2d80d601
- SHA512 abe9ff06aba159cb19735329feff630a393109f8389819b3a8a1a60fea23939307749c9a1ee849de656b56d4eabf34ff4335f95790d4e6aef79c7a4652f6c3f8
- SSDEEP 12288:lSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3uEW:EvO2xJKRw2kOkx2LFRvcUQPxW
- TLSH T15F156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH