Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 19:13
Behavioral task
behavioral1
Sample
a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe
- Size 560KB
- Sample260801-xw8rasvalh
- SHA256 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6
- MD5 db211525383109134a950ff8aa45b0d1
- SHA1 968019651521ffc800e23f0757a5397a13f2ceab
- SHA512 fb94fd01fff42f8d383d105da68e318cb04fed6e37ef70987323432d74f9243a2809fb51625a91400e79d7edc3cde131f784ec017da32f4e01625a05255af767
- SSDEEP 6144:iWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:ikCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T17CC47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2444 23014b73 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 30 223.5.5.5 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe Destination IP 3 114.114.114.114 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe Destination IP 4 223.5.5.5 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe Destination IP 29 114.114.114.114 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 23014b73 File created C:\Windows\SysWOW64\23014b73 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 23014b73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 23014b73 -
resource yara_rule behavioral1/memory/5000-0-0x0000000000090000-0x000000000011C000-memory.dmp upx behavioral1/memory/2444-3-0x0000000000270000-0x00000000002FC000-memory.dmp upx behavioral1/files/0x000a0000000004e9-2.dat upx behavioral1/memory/5000-20-0x0000000000090000-0x000000000011C000-memory.dmp upx behavioral1/memory/2444-21-0x0000000000270000-0x00000000002FC000-memory.dmp upx behavioral1/memory/2444-26-0x0000000000270000-0x00000000002FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\29d798 23014b73 File opened for modification C:\Windows\559a10 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23014b73 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 23014b73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 23014b73 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 23014b73 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 23014b73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 23014b73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 23014b73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 23014b73 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 23014b73 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 23014b73 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 2444 23014b73 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe Token: SeTcbPrivilege 5000 a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe Token: SeDebugPrivilege 2444 23014b73 Token: SeTcbPrivilege 2444 23014b73
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe"C:\Users\Admin\AppData\Local\Temp\a5b0cc1fa2e6380e47b18fdc65da9a3f79758f02ff09b9e246401a50233df4a6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
C:\Windows\Syswow64\23014b73C:\Windows\Syswow64\23014b731⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\29d798
- Size 506B
- SHA256 c69193989e8feef6f38aeff30f7567c58c8aa79f9e4567376290480b123f6f05
- MD5 dd81aecfaa1d657806a2f5ab90030fad
- SHA1 5d1c00a1497bb3c18f72bf15a8ddfcdad2967eac
- SHA512 219f284a9e2de1d352c000b3ae6ce9ffc9087fdcee67ddfdc3fcda8b0381371a718d5780316908ac558ea798c47c837c25cdc24b88b2544e3367ba319eb192c8
- TLSH T138F00E7EE43F2EA1A9DE1C63621EE404100F922ED10A714FA9D17C868CC1409BC03408
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\23014b73
- Size 560KB
- SHA256 14c3de464ee28206407a4ce509a57a88a30ce12193c1ea9320ca9211ef71bf7a
- MD5 07b9f90bb1522227cbad7298086e2239
- SHA1 0e4228f36dcb23c14b25d81f99d594bc142f71e7
- SHA512 c006a67d0cf02e5a9a767743937df58cd4504a28366e49fcceeab09f50c82c0d8a9061bdbd2a3b9684e9297c7dc00f1c270a041d35703ecc6014ed96ab35e60f
- SSDEEP 6144:OWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:OkCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T1D3C47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH