Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 06:19
Behavioral task
behavioral1
Sample
d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe
- Size 1.1MB
- Sample260802-g3jsravtbv
- SHA256 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8
- MD5 adca4334f26bce8a44de52311db32bb6
- SHA1 db17c2c598e7709f6d48469ffd3a5b0a1786015b
- SHA512 2062a99d4bc4065bbf01a101ed9a3336bd17b9a1cb0fa3578a83101359a9c2122f775457aadac7ce0b6e8d02160d07f33c62376154d179fa8208ef05192b75f4
- SSDEEP 12288:qSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:xvO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T16F357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4364 57e73f9d - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe Destination IP 4 223.5.5.5 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe Destination IP 32 114.114.114.114 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe Destination IP 33 223.5.5.5 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 57e73f9d File created C:\Windows\SysWOW64\57e73f9d d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 57e73f9d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 57e73f9d -
resource yara_rule behavioral2/memory/8-0-0x0000000000520000-0x00000000005AC000-memory.dmp upx behavioral2/memory/4364-3-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral2/files/0x000a000000011390-4.dat upx behavioral2/memory/8-23-0x0000000000520000-0x00000000005AC000-memory.dmp upx behavioral2/memory/4364-24-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral2/memory/4364-45-0x0000000000610000-0x000000000069C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4ab698 57e73f9d File opened for modification C:\Windows\2310 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57e73f9d - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 57e73f9d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 57e73f9d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 57e73f9d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 57e73f9d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 57e73f9d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 57e73f9d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 57e73f9d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 57e73f9d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 57e73f9d - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 4364 57e73f9d 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe Token: SeTcbPrivilege 8 d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe Token: SeDebugPrivilege 4364 57e73f9d Token: SeTcbPrivilege 4364 57e73f9d
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe"C:\Users\Admin\AppData\Local\Temp\d8b7220111695c4a6b3b00f3627a94beae983c34558a083d28038e07af5fb9e8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
C:\Windows\Syswow64\57e73f9dC:\Windows\Syswow64\57e73f9d1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4ab698
- Size 798B
- SHA256 224a4b00d2fe936c9703b9a5fca7120fa29e34e7ab8b954fbf67cddeb8274dd9
- MD5 8636ded11d740fc240490c397f1fcabc
- SHA1 a599dd7a1d1ab63cced49efc69d7f45baf6da17e
- SHA512 a6e54feb67aa4681b4f7f2bd3e78902578edd6304849aa410e66ce6bf95e0cfee7df17d05be1bc4acb88caf89111c2833d45c99fa81c17cf51dc0f0a4b5e1bf4
- TLSH T1FF01413DB9E820D217AF45F1AF13C5CCB126F13A307C102900876AC3E0A3C98980A436
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\57e73f9d
- Size 1.1MB
- SHA256 48a6f707cf4770a2ddac3635755109f5973889cb42827af43fcf1ec5e3736d2a
- MD5 32762b4c9f1676295c0eaf8e1bbefc5b
- SHA1 c193d62d3ad8318b654662e6e55fcfbc1ae3f0b3
- SHA512 ddd73317d50b3ea9f74c96235b334897539b6aaa9e0c0932e8439f71ba43e01c3956413805aec7aaf5f1f9443dcbb6018cf218ecbe1b0a49cb20c31c971f782b
- SSDEEP 12288:WSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:VvO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T172357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH