Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 01:11
Behavioral task
behavioral1
Sample
5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe
- Size 761KB
- Sample260807-bj4e6avejb
- SHA256 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648
- MD5 de45fef8a7ac00e196f809388addce3b
- SHA1 2ad4cd589f8fe650b6e56a58c4e25e1a47797032
- SHA512 b98838188aaa6c186214009546e918d0bdb7148027871b914d6dfd95b337065a7026414e40f6d5c58f2d6b07a7e9340bd31de3a6151a58067e88ffcce65d1423
- SSDEEP 12288:3SvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:CvO2xJKRw2kOkxSkW298B
- TLSH T1EFF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1320 c3a2dcec - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 102 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 103 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 236 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 322 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 323 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 376 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 166 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 292 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 293 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 95 114.114.114.114 1320 c3a2dcec Destination IP 96 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 235 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 4 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 40 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 165 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 377 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 2 114.114.114.114 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Destination IP 41 223.5.5.5 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c3a2dcec File created C:\Windows\SysWOW64\c3a2dcec 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c3a2dcec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c3a2dcec -
resource yara_rule behavioral2/memory/2812-0-0x0000000000B50000-0x0000000000BDC000-memory.dmp upx behavioral2/files/0x000b00000001136a-2.dat upx behavioral2/memory/1320-3-0x00000000003B0000-0x000000000043C000-memory.dmp upx behavioral2/memory/2812-16-0x0000000000B50000-0x0000000000BDC000-memory.dmp upx behavioral2/memory/1320-17-0x00000000003B0000-0x000000000043C000-memory.dmp upx behavioral2/memory/1320-40-0x00000000003B0000-0x000000000043C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\169950 c3a2dcec File opened for modification C:\Windows\302478 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c3a2dcec - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c3a2dcec Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c3a2dcec Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c3a2dcec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c3a2dcec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c3a2dcec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c3a2dcec Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c3a2dcec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c3a2dcec Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c3a2dcec - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1320 c3a2dcec 1320 c3a2dcec 1320 c3a2dcec 1320 c3a2dcec 1320 c3a2dcec 1320 c3a2dcec 1320 c3a2dcec 1320 c3a2dcec 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Token: SeTcbPrivilege 2812 5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe Token: SeDebugPrivilege 1320 c3a2dcec Token: SeTcbPrivilege 1320 c3a2dcec
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe"C:\Users\Admin\AppData\Local\Temp\5d1d56e3f0f8c58110dc10ab9a2d898e91d73fbbeb80b8dcdb1f28848bf8f648.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
C:\Windows\Syswow64\c3a2dcecC:\Windows\Syswow64\c3a2dcec1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c3a2dcec
- Size 761KB
- SHA256 e837a7e860563ef3080c0d234556e894140a74bcdbb31b8e986e5d2e7f19c691
- MD5 38b524a8e442045d7fbf8de6c1ef036e
- SHA1 b13b75e1fc86b05d304e543b058dc2687e46f0cd
- SHA512 7117a7901203b25da310095673e7750e2f6397b88f349414742e3c818ff349de114bae49011bedf186de15075ef652ddb5622f5ad03e2f0c5edcbb72f7a8f17e
- SSDEEP 12288:lSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:EvO2xJKRw2kOkxSkW298B
- TLSH T19EF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH