Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:58
Behavioral task
behavioral1
Sample
a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe
- Size 560KB
- Sample260802-bb2ats1sdx
- SHA256 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289
- MD5 f8b108400318516ba0e5411ddc75b94c
- SHA1 400849064d3f27de4420f4f4de1cf12788fdd972
- SHA512 60ea565a5b8119f63d451266b47faa549174fb3d36bf2fa8c50b453fb490d662bef891652b946b0560240f11deb389e2fe0c1e0f5eb57c53de064c38221cbd95
- SSDEEP 6144:E4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:ErNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T12BC48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5700 475ddeb1 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe Destination IP 4 223.5.5.5 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe Destination IP 18 114.114.114.114 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe Destination IP 19 223.5.5.5 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 475ddeb1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 475ddeb1 File created C:\Windows\SysWOW64\475ddeb1 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 475ddeb1 -
resource yara_rule behavioral2/memory/4280-0-0x00000000003D0000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0006000000006977-2.dat upx behavioral2/memory/5700-3-0x0000000000380000-0x000000000040C000-memory.dmp upx behavioral2/memory/4280-23-0x00000000003D0000-0x000000000045C000-memory.dmp upx behavioral2/memory/5700-24-0x0000000000380000-0x000000000040C000-memory.dmp upx behavioral2/memory/5700-43-0x0000000000380000-0x000000000040C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\619608 475ddeb1 File opened for modification C:\Windows\494670 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 475ddeb1 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 475ddeb1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 475ddeb1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 475ddeb1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 475ddeb1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 475ddeb1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 475ddeb1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 475ddeb1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 475ddeb1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 475ddeb1 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 5700 475ddeb1 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe Token: SeTcbPrivilege 4280 a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe Token: SeDebugPrivilege 5700 475ddeb1 Token: SeTcbPrivilege 5700 475ddeb1
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe"C:\Users\Admin\AppData\Local\Temp\a6202da47aa8aed90e50cee095e0cc025142bb69725bef50da5144b2acef4289.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
C:\Windows\Syswow64\475ddeb1C:\Windows\Syswow64\475ddeb11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\619608
- Size 916B
- SHA256 6c89dcd9fb7478a81194e3a563366fdce29cfe1d80c6f6393959c1c951d6ad90
- MD5 6c1e047b9a2b20fd5b90fd5c06d9b6ef
- SHA1 f24bec6299125d175d6b965c68eff9b2db95172f
- SHA512 6c1daf1fa8c1a7fd16f2e1a53dec9b26d89ab1ddca7e6956d6e5b368e30be2bae38f938dc50c1f798ef4f656fb2fe94a7ad4efd6605800ab85adce4d14b8b0b3
- TLSH T1DA115C76749A768F14E8EF209592CDCBB7337890D19B443FC1C42021999A63D9E5393B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\475ddeb1
- Size 560KB
- SHA256 37b3f8a6b063075ef0bc603e5dd286d398cd1d850d4ab2163644009248697bd7
- MD5 7ebf132589ff7d15b9231cd4641fde8c
- SHA1 37cdcd155dd4bf8f4fa17547702ccccfe40bbc7c
- SHA512 178a9b486d5d690ade89c7d49da85ba1dc5cc34d5cf17b8f2066bd5f792e880be4ee4064b11e3b97144eb9a69935b83bdc79c3560f79a82ab656292a9673c5df
- SSDEEP 6144:f4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:frNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T154C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH