Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 01:18
Behavioral task
behavioral1
Sample
a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe
- Size 618KB
- Sample260807-bpap2aysey
- SHA256 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31
- MD5 fc7ac4b36b057d012d35de0269766a2c
- SHA1 976e2515cb25083bcce83a51d488be003fa9dbcd
- SHA512 54169f73e668278d26184ab05f4daf6789b415688945349722bfb614584dbd509429641a711014f156148c9de520858e9b57a8e0c23b1e620bb68c6c34b8b753
- SSDEEP 12288:PqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:PjHPOSOkx2LFscUQPxW
- TLSH T10FD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1432 ac496460 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe Destination IP 4 223.5.5.5 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe Destination IP 15 114.114.114.114 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe Destination IP 16 223.5.5.5 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ac496460 File created C:\Windows\SysWOW64\ac496460 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ac496460 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ac496460 -
resource yara_rule behavioral2/memory/2624-0-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/files/0x000a000000019cc9-2.dat upx behavioral2/memory/1432-3-0x0000000000AE0000-0x0000000000B69000-memory.dmp upx behavioral2/memory/2624-16-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/1432-18-0x0000000000AE0000-0x0000000000B69000-memory.dmp upx behavioral2/memory/2624-31-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/1432-32-0x0000000000AE0000-0x0000000000B69000-memory.dmp upx behavioral2/memory/2624-41-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/2624-46-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\188430 ac496460 File opened for modification C:\Windows\2cec80 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac496460 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ac496460 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ac496460 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ac496460 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ac496460 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ac496460 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ac496460 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ac496460 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ac496460 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ac496460 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1432 ac496460 1432 ac496460 1432 ac496460 1432 ac496460 1432 ac496460 1432 ac496460 1432 ac496460 1432 ac496460 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe Token: SeTcbPrivilege 2624 a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe Token: SeDebugPrivilege 1432 ac496460 Token: SeTcbPrivilege 1432 ac496460
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe"C:\Users\Admin\AppData\Local\Temp\a2c4501c2653156ed0d93d2ac160d0e514eb7b6c24b8884f18c32954f665cf31.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\Syswow64\ac496460C:\Windows\Syswow64\ac4964601⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ac496460
- Size 618KB
- SHA256 28abd1cf940cd9c33d592a11f3bd70e85df4a1b8698148e339f48078bfa11fe9
- MD5 38a1e1f490a164b29148de819756444b
- SHA1 903e648ae6b4aa344fefa0777c3a3b8d5f4c9ef7
- SHA512 a26f2bb6de193f7c6a50846e14731ff6029dc6e0641bef72ca8c63977ac8f4a8372659a86eace605b8f347f75e833a160211a2e934e102048b5a9edc48aa3f81
- SSDEEP 12288:eqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:ejHPOSOkx2LFscUQPxW
- TLSH T1ADD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH