Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 12:02
Behavioral task
behavioral1
Sample
13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe
- Size 618KB
- Sample260802-n7e4pasdnc
- SHA256 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d
- MD5 06ce4b1fad14b6434c0082d2a56a0954
- SHA1 5318359342759fe3aa853514a64d9dee9ceaa1e1
- SHA512 288af76a63b69e7a2b939ec402a9d7c5780569eab4e195a95192b596be7aa7306d1b1e121669ebee2007e5154e205d45ef2e66761c618ffca4fb76931e056f1d
- SSDEEP 12288:AqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:AjHPOSOkx2LFscUQPxW
- TLSH T171D47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4808 a0e7adb4 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe Destination IP 8 223.5.5.5 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe Destination IP 13 114.114.114.114 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe Destination IP 14 223.5.5.5 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a0e7adb4 File created C:\Windows\SysWOW64\a0e7adb4 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a0e7adb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a0e7adb4 -
resource yara_rule behavioral2/memory/5448-0-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx behavioral2/files/0x000a00000001b315-2.dat upx behavioral2/memory/4808-3-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral2/memory/5448-10-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx behavioral2/memory/4808-12-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral2/memory/5448-25-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx behavioral2/memory/4808-26-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral2/memory/4808-33-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral2/memory/5448-46-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\525090 a0e7adb4 File opened for modification C:\Windows\5d4590 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0e7adb4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a0e7adb4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a0e7adb4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a0e7adb4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a0e7adb4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a0e7adb4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a0e7adb4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a0e7adb4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a0e7adb4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a0e7adb4 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4808 a0e7adb4 4808 a0e7adb4 4808 a0e7adb4 4808 a0e7adb4 4808 a0e7adb4 4808 a0e7adb4 4808 a0e7adb4 4808 a0e7adb4 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe Token: SeTcbPrivilege 5448 13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe Token: SeDebugPrivilege 4808 a0e7adb4 Token: SeTcbPrivilege 4808 a0e7adb4
Processes
-
C:\Users\Admin\AppData\Local\Temp\13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe"C:\Users\Admin\AppData\Local\Temp\13f587f66897b0b43ad738547077f239ca80af24d66cb5485027c533d048ae7d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5448
-
C:\Windows\Syswow64\a0e7adb4C:\Windows\Syswow64\a0e7adb41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a0e7adb4
- Size 618KB
- SHA256 af1081b7d3a56233b0ca62949aeb59bc7ec2876a61007ca52f9083ce3e830cf9
- MD5 e408e5eb7e8a54f3150e6020567cc3c0
- SHA1 41df108ca379e306658b0ab71a06356fedd0984c
- SHA512 2bae5931c07bb351cec5833681802bfac992cdaac5810736b51910531f6ca68b2271fdb2d1109eefd3b0f3db8fc2f9047c97a8533219fa8da7f9c690d4e1ae1b
- SSDEEP 12288:1qXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:1jHPOSOkx2LFscUQPxW
- TLSH T1DBD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH