Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe
- Size 384KB
- Sample260802-qch8zaar3t
- SHA256 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364
- MD5 7b694959c7dfc4c898b37eb2dcff797c
- SHA1 c86e97ccba9f3858a85574c61ebe35a6b076d790
- SHA512 b959a872f57b8b96df0d2a55cb5be3304b4e4f8ad21e91a5a31651f9983a7b3782016f2c138c927bbc8afa2b4048dcaca50cea965faeff3b3688ff1821e723a6
- SSDEEP 6144:WcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8Kl:WSvO2x9mONvKRILSFnOkx2LIaxy/
- TLSH T17F846E2AF6A0D076C4779579C4A257AAFBB1B42137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1472 112b5c20 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 51 223.5.5.5 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Destination IP 1 114.114.114.114 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Destination IP 3 223.5.5.5 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Destination IP 12 114.114.114.114 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Destination IP 13 223.5.5.5 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Destination IP 50 114.114.114.114 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\112b5c20 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 112b5c20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 112b5c20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 112b5c20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 112b5c20 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\193380 112b5c20 File opened for modification C:\Windows\3bebd8 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 112b5c20 - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 112b5c20 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 112b5c20 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 112b5c20 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 112b5c20 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 112b5c20 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 112b5c20 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 112b5c20 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 112b5c20 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 1472 112b5c20 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Token: SeTcbPrivilege 3500 de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe Token: SeDebugPrivilege 1472 112b5c20 Token: SeTcbPrivilege 1472 112b5c20
Processes
-
C:\Users\Admin\AppData\Local\Temp\de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe"C:\Users\Admin\AppData\Local\Temp\de6fb35dc57a4b05d082b7b258c715401227aa3be4d33284462c39440dbdd364.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
C:\Windows\Syswow64\112b5c20C:\Windows\Syswow64\112b5c201⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\193380
- Size 916B
- SHA256 228e1dd4275fceb11647da45a25d30cb86413d6bfe3a0eb8c888ffe1c9d74a6a
- MD5 71618bcb91911e44981b620291d5ed00
- SHA1 265502f07139d3ba1275bcd0a75edbc433f58c43
- SHA512 1d4ef145a8485999e862c663869b556331d4ccb2ffaae6b3678f0c98b86bda274a07cba8237638bc2788fb294d36ca21e0c4bc5e61b71e4b6780f29f0e0ce1a2
- TLSH T17A118CFA74DDAAE627F0A52492DB0EEF7A3076D4C59A4033C64138A05863279CC071FB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\112b5c20
- Size 384KB
- SHA256 ed020f98cc578067ebcb0780ff87f337810d67ef4eb60647b32377f2183212b7
- MD5 8fef89c73c29212bd256746237d3b10b
- SHA1 188bb7e60cf9992198eb368c9c0a369d2f4b25bb
- SHA512 54eb079350cee2a8408675789cb30cfc5ca24052963d3c3bc9a0a3b0c1effba8702ff473c58ff5915946a9cbfcab55abd7291bc14bfb82d2c74d24e7a8c69861
- SSDEEP 6144:AcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8Kl:ASvO2x9mONvKRILSFnOkx2LIaxy/
- TLSH T109846E2AF6A0D076C4779579C4A257AAFBB1B42137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH