Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 04:15
Behavioral task
behavioral1
Sample
f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe
- Size 576KB
- Sample260801-evgbjsde49
- SHA256 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f
- MD5 edf907e9965288ed452ca579a537e685
- SHA1 885e41f4ffb1f8d7682aacb73c6536ca573c8d92
- SHA512 2a9ee93153a02f6c4d26b5e9005b0c42aee90237a1d0a153174ec34c7e3eb09dc7fd74bd9160bb0dc50c85da14ddae686c7f36b8f01a8f977e611e75d42ec519
- SSDEEP 6144:ccTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:cSvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T1FEC46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1116 51bc0d15 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe Destination IP 5 223.5.5.5 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe Destination IP 51 114.114.114.114 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe Destination IP 53 223.5.5.5 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 51bc0d15 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 51bc0d15 File created C:\Windows\SysWOW64\51bc0d15 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe -
resource yara_rule behavioral1/memory/436-0-0x0000000000130000-0x00000000001BC000-memory.dmp upx behavioral1/files/0x001200000002416d-2.dat upx behavioral1/memory/1116-4-0x0000000000C50000-0x0000000000CDC000-memory.dmp upx behavioral1/memory/436-12-0x0000000000130000-0x00000000001BC000-memory.dmp upx behavioral1/memory/1116-13-0x0000000000C50000-0x0000000000CDC000-memory.dmp upx behavioral1/memory/1116-35-0x0000000000C50000-0x0000000000CDC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\131b38 51bc0d15 File opened for modification C:\Windows\776e8 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51bc0d15 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 51bc0d15 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 51bc0d15 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 51bc0d15 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 51bc0d15 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 51bc0d15 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 51bc0d15 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 51bc0d15 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 51bc0d15 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 51bc0d15 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 1116 51bc0d15 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe Token: SeTcbPrivilege 436 f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe Token: SeDebugPrivilege 1116 51bc0d15 Token: SeTcbPrivilege 1116 51bc0d15
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe"C:\Users\Admin\AppData\Local\Temp\f0f7de76c1d5a35b259627f12a27b7541686841401a248b645b26ecd6de4aa3f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436
-
C:\Windows\Syswow64\51bc0d15C:\Windows\Syswow64\51bc0d151⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\131b38
- Size 650B
- SHA256 311b5cb59dade94e51cab5f73e4e49ddc67cf74e7742bdc40f74b318284bfa92
- MD5 a6daf26397c922c5b7b0e4513e137e88
- SHA1 1823912a4951ef4e6edbf97f24947d2e06d3eb11
- SHA512 c1c4bd66b31956d14e875b4e415b80474df73a07ee7a211f4041eabdd9eeb13beb7b7c305da7b519f582e4852d94878f9b692fa56b599b33aac50b99849fcac3
- TLSH T100F02D6492AD76C72CFA68D7B3050BBC0F22E52A2095223BB602E8F11652E068D03442
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\51bc0d15
- Size 576KB
- SHA256 d4e90b9152d8e52b21611927db15751c116cc3983ec00d499c30c8c2100180bb
- MD5 8db8aa70648f608b4482cfefc3058b0a
- SHA1 42ddf1ecd6bc47807de0e7bbd5f60985139eb0cd
- SHA512 893577c1a633b87cbfa68a0b13c93a38667355275bbddb531152859e6eaaf8f5741dfb2c82e27bf0020ca356cd37898981e2d3adc8fb6c3e28611b1c0abf8b19
- SSDEEP 6144:7cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:7SvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T1F9C46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH