Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 00:09
Behavioral task
behavioral1
Sample
8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe
- Size 873KB
- Sample260807-aft7mstemb
- SHA256 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad
- MD5 2d7091c7deaaa84808e23a62560a83e2
- SHA1 627b3734c205bb6f382b0d6b4190bc672cc2386d
- SHA512 8c8cce6323620ae9cbc5d8e00050aa44f0fe1ae4a5b31d252c61f82868f915a6d0d14015d750468daae7792602ff633633f213025339ce1cf7b143384714a892
- SSDEEP 12288:1SvO2x9mONvKRhLSFtsOkx2LIaeyk5FAQjU/Lik8CQ3uEW:0vO2xJKRh2kOkx2LFxNcUQPxW
- TLSH T1BB156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5072 20e562c1 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 113 114.114.114.114 5072 20e562c1 Destination IP 137 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 278 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 48 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 114 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 347 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 379 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 438 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 4 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 49 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 134 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 204 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 378 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 439 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 3 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 201 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 277 114.114.114.114 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Destination IP 348 223.5.5.5 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 20e562c1 File created C:\Windows\SysWOW64\20e562c1 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 20e562c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 20e562c1 -
resource yara_rule behavioral1/memory/2332-0-0x00000000001C0000-0x000000000024C000-memory.dmp upx behavioral1/files/0x001800000001db66-2.dat upx behavioral1/memory/5072-4-0x00000000007C0000-0x000000000084C000-memory.dmp upx behavioral1/memory/2332-16-0x00000000001C0000-0x000000000024C000-memory.dmp upx behavioral1/memory/5072-19-0x00000000007C0000-0x000000000084C000-memory.dmp upx behavioral1/memory/5072-36-0x00000000007C0000-0x000000000084C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\56d5a0 20e562c1 File opened for modification C:\Windows\27ecb8 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20e562c1 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 20e562c1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 20e562c1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 20e562c1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 20e562c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 20e562c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 20e562c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 20e562c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 20e562c1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 20e562c1 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5072 20e562c1 5072 20e562c1 5072 20e562c1 5072 20e562c1 5072 20e562c1 5072 20e562c1 5072 20e562c1 5072 20e562c1 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Token: SeTcbPrivilege 2332 8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe Token: SeDebugPrivilege 5072 20e562c1 Token: SeTcbPrivilege 5072 20e562c1
Processes
-
C:\Users\Admin\AppData\Local\Temp\8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe"C:\Users\Admin\AppData\Local\Temp\8be9082aefd1430563aee88d3c79872df709f2615965ef7508b777631a4582ad.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
C:\Windows\Syswow64\20e562c1C:\Windows\Syswow64\20e562c11⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\20e562c1
- Size 873KB
- SHA256 ad21f33f15306e1a533e18afca963bf3cbec6deeed9b9e3caa8d28bea1e223f7
- MD5 63a5b981d255ee8f5bb9726ee4cc4f3a
- SHA1 65d1262216a09996a45c3e6a4f0afc18862cedf0
- SHA512 00f1a4ced86f029750958e8db29b011e7e1565eb6653bebf3880d99c4d0411cf7c7c932557984273249aa3648641a1f1e3c7670a0a07d01766cc24cad8bbcb6e
- SSDEEP 12288:kSvO2x9mONvKRhLSFtsOkx2LIaeyk5FAQjU/Lik8CQ3uEW:XvO2xJKRh2kOkx2LFxNcUQPxW
- TLSH T1E8156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH