Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 00:36
Behavioral task
behavioral1
Sample
488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe
- Size 766KB
- Sample260805-axyamavara
- SHA256 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9
- MD5 4010fe17599774efecb521f3f308a123
- SHA1 a0285460755d956b2c94bfef22264657cb4e4d04
- SHA512 ea6c2737b9330baa6123168dc607ad1ffd6b4719ef33d04ca1cd0d53ad9dc8a663a78a1eff36164c2b7befc602057f2238348aafeb04a24be8cdb54e1eb69b6c
- SSDEEP 12288:/SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:KvO2xJKRw2kOkx2LFRvcUV
- TLSH T1F5F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2876 a1478936 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe Destination IP 4 223.5.5.5 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe Destination IP 14 114.114.114.114 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe Destination IP 15 223.5.5.5 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a1478936 File created C:\Windows\SysWOW64\a1478936 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a1478936 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a1478936 -
resource yara_rule behavioral2/memory/5108-0-0x0000000000300000-0x000000000038C000-memory.dmp upx behavioral2/files/0x000f000000016cdb-2.dat upx behavioral2/memory/2876-3-0x00000000003C0000-0x000000000044C000-memory.dmp upx behavioral2/memory/5108-17-0x0000000000300000-0x000000000038C000-memory.dmp upx behavioral2/memory/2876-18-0x00000000003C0000-0x000000000044C000-memory.dmp upx behavioral2/memory/2876-42-0x00000000003C0000-0x000000000044C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\313cf8 a1478936 File opened for modification C:\Windows\577368 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1478936 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a1478936 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a1478936 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a1478936 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a1478936 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a1478936 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a1478936 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a1478936 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a1478936 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a1478936 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 2876 a1478936 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe Token: SeTcbPrivilege 5108 488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe Token: SeDebugPrivilege 2876 a1478936 Token: SeTcbPrivilege 2876 a1478936
Processes
-
C:\Users\Admin\AppData\Local\Temp\488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe"C:\Users\Admin\AppData\Local\Temp\488b41db2ae10be8f946a69cfbe49635624a43e8ef6a5bc3ccb65bc5acd2c6c9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Windows\Syswow64\a1478936C:\Windows\Syswow64\a14789361⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\313cf8
- Size 916B
- SHA256 0dc646308752411712a99de09f90289b35c732ba449bdd350efbe1545ba4a833
- MD5 de6f6f0131ae5dabc81a1c81e2f25fe7
- SHA1 e7f33d77400a3793fec4eea51489a32b19b47739
- SHA512 a86663c729e42fafcd737fd5024dee8f0655614555dcfed3bbf51bc86bbf78748c0f62d4a4abf4dab29830ec9fd20602825ca845d5db923662f1dc50893db34a
- TLSH T1BA115C7794A9D3A9CCD94161B9E39DEBBB32349FC4CE402B2E83B46819163DCCA21141
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\a1478936
- Size 766KB
- SHA256 30b01482e68716fef900416812c71ad012ca4c3e83d4e518d9ed0afb1406324a
- MD5 c02dd5dd4e27a7ed47970d16920dcd3e
- SHA1 314a4bd080a0a059e403dd0808e930a0f92dece2
- SHA512 d7e9a9be3b9b5a734b3362f40fc0605d31566e6b2de92e6f78e2c116966552248204d715c2617762b78ef5d9cffa29a545f1d670145b6c9eb30b385944fe683f
- SSDEEP 12288:fSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:qvO2xJKRw2kOkx2LFRvcUV
- TLSH T18DF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH