Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe
- Size 1.9MB
- Sample260730-drtxss11bt
- SHA256 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d
- MD5 9fa9201e3294256640ead3de628a875a
- SHA1 9588d97946a1a42f14353fbd3dc11f6a450f6f69
- SHA512 612062b8ffc3b8550dd59a51a7b7a88e89c4f4ed6533658f96936fba194a998e8d5542f2782df3487275b104b7927f8f20e4a290afef4275a164aa58c8c3a407
- SSDEEP 49152:iHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmT4:inKdBWsM0r1Qn1K4XM
- TLSH T17A95AF21F351C036D4AB01758ABA47AEA578BD21472551CBB3C47A7E5FB23D2AE3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5024 4d9f8350 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Destination IP 2 223.5.5.5 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Destination IP 17 114.114.114.114 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Destination IP 18 223.5.5.5 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe - Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\4d9f8350 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 4d9f8350 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 4d9f8350 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2f4090 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe File opened for modification C:\Windows\560340 4d9f8350 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d9f8350 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 4d9f8350 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 4d9f8350 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 4d9f8350 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 4d9f8350 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 4d9f8350 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 4d9f8350 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 4d9f8350 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 4d9f8350 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 4d9f8350 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 5024 4d9f8350 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Token: SeTcbPrivilege 2760 dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe Token: SeDebugPrivilege 5024 4d9f8350 Token: SeTcbPrivilege 5024 4d9f8350
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe"C:\Users\Admin\AppData\Local\Temp\dc0b731b33458b5f32609e484b715237a00b3ec3c0eed1b397a33ecf4b218a2d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
C:\Windows\Syswow64\4d9f8350C:\Windows\Syswow64\4d9f83501⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\560340
- Size 1KB
- SHA256 23e2f7a28d5309d215e5667d5f0d409f1eaedad4a2fa90c0b79b1aaf0ba5aa1b
- MD5 9521a3517fe6898daf1f119187fdf910
- SHA1 d013e4515f0d6a1807b45ac25164fe1b3f6f3b17
- SHA512 5fd6fd3c3f7017f7ff1306887bbe63bdbead646426a60e7d3709477f17eaa7b870bfe2ec0f8ce630ffb5a7e9b7e29896db9fc99939c16eb3f1232ad7777aad8b
- TLSH T1D021022DB4FC70F05ABF66966A57C8C4B932A0374215634A04EB28E778E37D8AD17436
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\4d9f8350
- Size 1.9MB
- SHA256 701dc438b6ae02dffacd0fd7cf74c33ab0d716fa059091bfc4dc361b08715063
- MD5 75b769d62c4620b6701ead7f29229cc8
- SHA1 c82d15fbeb3bbec3123ea130177dda11f29614a0
- SHA512 98f361d1ab33bb3491f60ed7af3dd742117a4273a00a0deabd034f2cbf254c1f3c619a4e1ef61b8bbd4dc680984e811305aea2e1beb1ededbf463e1da4eeda6f
- SSDEEP 49152:BHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmT4:BnKdBWsM0r1Qn1K4XM
- TLSH T1D895AF21F351C036D4AB01758ABA47AEA578BD21472551CBB3C47A7E5FB23D2AE3130E
- MD5 SHA1 SHA512 SSDEEP TLSH