Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe
- Size 1.9MB
- Sample260730-drtxss11bt
- SHA256 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d
- MD5 9fa9201e3294256640ead3de628a875a
- SHA1 9588d97946a1a42f14353fbd3dc11f6a450f6f69
- SHA512 612062b8ffc3b8550dd59a51a7b7a88e89c4f4ed6533658f96936fba194a998e8d5542f2782df3487275b104b7927f8f20e4a290afef4275a164aa58c8c3a407
- SSDEEP 49152:iHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmT4:inKdBWsM0r1Qn1K4XM
- TLSH T17A95AF21F351C036D4AB01758ABA47AEA578BD21472551CBB3C47A7E5FB23D2AE3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2824 1aa36abb - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 28 223.5.5.5 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Destination IP 3 114.114.114.114 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Destination IP 6 223.5.5.5 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Destination IP 27 114.114.114.114 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1aa36abb File created C:\Windows\SysWOW64\1aa36abb dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1aa36abb File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1aa36abb - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\523f08 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe File opened for modification C:\Windows\305910 1aa36abb - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1aa36abb - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1aa36abb Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1aa36abb Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1aa36abb Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1aa36abb Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1aa36abb Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1aa36abb Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1aa36abb Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1aa36abb Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1aa36abb - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 2824 1aa36abb 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Token: SeTcbPrivilege 4804 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Token: SeDebugPrivilege 2824 1aa36abb Token: SeTcbPrivilege 2824 1aa36abb
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe"C:\Users\Admin\AppData\Local\Temp\dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
C:\Windows\Syswow64\1aa36abbC:\Windows\Syswow64\1aa36abb1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1aa36abb
- Size 1.9MB
- SHA256 1603f805dbb4c7805ff01fee03473b11390d3092b86c60947ef172104e98244f
- MD5 c1ff805745f786827ebc2b2ad47ac106
- SHA1 292c840a39c7813b91e6f9303e46d10efc7e3261
- SHA512 f8b8d38a095274c492aa162b89b9eefb817bdc9b0aa2793dbcd3668c7c57a6614655b91f8b5c3e3511872e176885e0ac11caca985269e289b03ae604775e806c
- SSDEEP 49152:ZHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmT4:ZnKdBWsM0r1Qn1K4XM
- TLSH T1E595AF21F351C036D4AB01758ABA47AEA578BD21472551CBB3C47A7E5FB23D2AE3130E
- MD5 SHA1 SHA512 SSDEEP TLSH