Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 00:07
Behavioral task
behavioral1
Sample
de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe
- Size 766KB
- Sample260807-aearlsda36
- SHA256 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892
- MD5 98ff2f57d6c611b5b3b5d25fa8994f3d
- SHA1 85f95beb66c7936d4c895468014b54ceb7ea0666
- SHA512 1afc58b742dd6d5d636f530a65481aad3b9358a8805cecfdaaecbfbe556b5cb569fca5ee2b02351dc56e5a9f43f9abd9f0d573dc885d51353e1cc66f0f8d1d94
- SSDEEP 12288:xSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:YvO2xJKRw2kOkx2LFRvcUV
- TLSH T120F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1672 cd077aa3 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 55 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 130 114.114.114.114 1672 cd077aa3 Destination IP 224 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 463 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 464 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 54 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 159 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 225 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 298 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 371 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 2 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 131 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 299 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 372 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 402 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 403 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 4 223.5.5.5 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Destination IP 157 114.114.114.114 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cd077aa3 File created C:\Windows\SysWOW64\cd077aa3 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cd077aa3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cd077aa3 -
resource yara_rule behavioral1/memory/5104-0-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral1/files/0x000a000000024173-2.dat upx behavioral1/memory/1672-4-0x0000000000030000-0x00000000000BC000-memory.dmp upx behavioral1/memory/5104-16-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral1/memory/1672-19-0x0000000000030000-0x00000000000BC000-memory.dmp upx behavioral1/memory/1672-36-0x0000000000030000-0x00000000000BC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5761e0 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe File opened for modification C:\Windows\1ca010 cd077aa3 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd077aa3 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cd077aa3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cd077aa3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cd077aa3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cd077aa3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cd077aa3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cd077aa3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cd077aa3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cd077aa3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cd077aa3 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1672 cd077aa3 1672 cd077aa3 1672 cd077aa3 1672 cd077aa3 1672 cd077aa3 1672 cd077aa3 1672 cd077aa3 1672 cd077aa3 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Token: SeTcbPrivilege 5104 de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe Token: SeDebugPrivilege 1672 cd077aa3 Token: SeTcbPrivilege 1672 cd077aa3
Processes
-
C:\Users\Admin\AppData\Local\Temp\de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe"C:\Users\Admin\AppData\Local\Temp\de7644e91e9e33c2fd5e7f99e54eb0223a444aa45bc1e073f0d1425bee75a892.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
C:\Windows\Syswow64\cd077aa3C:\Windows\Syswow64\cd077aa31⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cd077aa3
- Size 766KB
- SHA256 ed544b6f8f4f73daf6466b54072ff5fb3be84645bae592c64cb2cf8a53160f55
- MD5 92d5b84db2b158f99bf4fbf5da1d1c2b
- SHA1 e9495df863b2768451f7d3f92857a7d28fa64802
- SHA512 8d3f8e16b02757b0666476bbecd208653f7d80baf38ac6db1ef957c165e72b14a3a3bb8d8a0bb80faea74ae0fe3649ce2d907e2b0e53d69e63d34e2c463a941a
- SSDEEP 12288:1SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:0vO2xJKRw2kOkx2LFRvcUV
- TLSH T1BEF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH