Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:13
Behavioral task
behavioral1
Sample
93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe
- Size 1.4MB
- Sample260730-dqtkmsbr7v
- SHA256 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40
- MD5 5bbd175fbc4cc0993ee27a5c3d7a1636
- SHA1 e212ecb3efd07baad20da69d034062d733d4e377
- SHA512 d85fa4625985a1ba4cf154abe11bd585824a48f8ad6f8d8d7ce4d53bf0dd04dd14b5b554ada0b540d4acf4450436e71dffb6896f77edcd407b3ef45614ca7dac
- SSDEEP 24576:3jHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA0I:3TGkQy5QZuTtS0rQMYOQ+q8CE0I
- TLSH T1B665AE21B341C036D59A01758ABE4BAE957CBD314B2551C7B3C87E7E6FB12D2AA3130B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 408 3202d0e3 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe Destination IP 2 223.5.5.5 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe Destination IP 21 114.114.114.114 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe Destination IP 22 223.5.5.5 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\3202d0e3 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 3202d0e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3202d0e3 -
resource yara_rule behavioral2/memory/2572-0-0x00000000002D0000-0x0000000000359000-memory.dmp upx behavioral2/memory/408-3-0x0000000000140000-0x00000000001C9000-memory.dmp upx behavioral2/files/0x000f000000016cdb-2.dat upx behavioral2/memory/2572-20-0x00000000002D0000-0x0000000000359000-memory.dmp upx behavioral2/memory/408-22-0x0000000000140000-0x00000000001C9000-memory.dmp upx behavioral2/memory/2572-44-0x00000000002D0000-0x0000000000359000-memory.dmp upx behavioral2/memory/408-45-0x0000000000140000-0x00000000001C9000-memory.dmp upx behavioral2/memory/408-52-0x0000000000140000-0x00000000001C9000-memory.dmp upx behavioral2/memory/2572-58-0x00000000002D0000-0x0000000000359000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\6fc30 3202d0e3 File opened for modification C:\Windows\2c0898 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3202d0e3 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3202d0e3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3202d0e3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3202d0e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3202d0e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3202d0e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3202d0e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3202d0e3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3202d0e3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3202d0e3 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 408 3202d0e3 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe Token: SeTcbPrivilege 2572 93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe Token: SeDebugPrivilege 408 3202d0e3 Token: SeTcbPrivilege 408 3202d0e3
Processes
-
C:\Users\Admin\AppData\Local\Temp\93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe"C:\Users\Admin\AppData\Local\Temp\93e13998838914f0503fcb7a0c956f15ae131bb42ef2d1c1b61e8f2e6191bd40.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
C:\Windows\Syswow64\3202d0e3C:\Windows\Syswow64\3202d0e31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\6fc30
- Size 900B
- SHA256 1904d05811da00d1072d54fddcaacde37e506f5b191c2c5f2fc4ca0b8138305b
- MD5 054198e94dea17c310d71e5977003c71
- SHA1 24fb655dc72601daa74f95a3acfd4af76b06818d
- SHA512 996ff210754114958838b85663909afb7264edfbeeacdf94c8233e857532641929ab1a97200b5819839352d33f0175dc60bc977c786caa7ea0bad526107a94b1
- TLSH T1DE114C739056E3619CD983A07AF7B8CEB73074BBCBCD11173882610958133DCE23A501
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\3202d0e3
- Size 1.4MB
- SHA256 f921fb4334aff60aa5c565e426c6efb8b02cd221c99f7b60039ef5c714e32d61
- MD5 ec8a044ca56841416797bb0c4017ee42
- SHA1 f80a041cad9da87e8810dd6377ea820579268f6c
- SHA512 b7985cfc47453b51a3591ea2fd49b81c4312bee4983450f60f3f921c6a9c564bf1b15df711a01c9698c2a7f1406e3146a6824de64219d2a12d7dff2ebd82c880
- SSDEEP 24576:kjHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA0I:kTGkQy5QZuTtS0rQMYOQ+q8CE0I
- TLSH T13665AE21B341C036D59A01758ABE4BAE957CBD314B2551C7B3C87E7E6FB12D2AA3130B
- MD5 SHA1 SHA512 SSDEEP TLSH