Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe
- Size 3.7MB
- Sample260804-peatyazcmf
- SHA256 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e
- MD5 9bf9d5d825cfe5f6c7c6804950af734c
- SHA1 f79ba126f60aeef3e3dcaba4d26b81e1d6892f22
- SHA512 a6cf02af18faf1d2dde836f04663783e55d11716ba1aff87a1cc65898ac4e4ac3f884eaad13745dddb0e87ab84d4c99eb17558f30403e5df332d1265bcf19953
- SSDEEP 49152:wQQZ7J+34uYz2vpAtvvgRwdKM556IhWgBKOAfYtuJM7tBHyptdoYeyh:wPo3Jb1qZtK07fSptdoZE
- TLSH T10A06CF4AB3A515E8C177C13C8942C63AE7B2BC4513218BCB11F88E97BF136E11E7A765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Unexpected DNS network traffic destination 25 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 52 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 63 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 66 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 71 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 23 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 29 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 62 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 3 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 4 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 18 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 28 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 31 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 56 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 61 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 70 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 20 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 21 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 22 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 24 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 30 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 46 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 47 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 49 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 38 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Destination IP 50 114.114.114.114 4308 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 29356d108637b53711b655690f9345bf3f060ce08142955b596629daf1551c5e.exe