Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 01:19
Behavioral task
behavioral1
Sample
d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe
- Size 1024KB
- Sample260807-bpzddsvepg
- SHA256 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c
- MD5 dce01f82678b0e98a63750fb2d651d1d
- SHA1 59da487f512e9d79a70d99e5bd3a7e34e72101e6
- SHA512 b7f8e9393e237f0a4396e71993c7e4b407e72f214fef86fdd7a1d741f33cdf07f9893d5d3d2cf43adcbec0701669868da647f7909f2fa5906452a373e41755a6
- SSDEEP 24576:AjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:ATGkQyhuTtS0rQi
- TLSH T15525AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3876 bb830e78 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 318 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 319 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 372 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 289 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 1 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 2 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 98 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 161 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 231 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 373 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 232 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 288 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 35 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 91 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 97 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 36 223.5.5.5 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 90 114.114.114.114 3876 bb830e78 Destination IP 160 114.114.114.114 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bb830e78 File created C:\Windows\SysWOW64\bb830e78 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bb830e78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bb830e78 -
resource yara_rule behavioral2/memory/5796-0-0x0000000000770000-0x00000000007F9000-memory.dmp upx behavioral2/files/0x00170000000115ef-2.dat upx behavioral2/memory/3876-3-0x00000000008B0000-0x0000000000939000-memory.dmp upx behavioral2/memory/5796-18-0x0000000000770000-0x00000000007F9000-memory.dmp upx behavioral2/memory/3876-20-0x00000000008B0000-0x0000000000939000-memory.dmp upx behavioral2/memory/5796-43-0x0000000000770000-0x00000000007F9000-memory.dmp upx behavioral2/memory/3876-44-0x00000000008B0000-0x0000000000939000-memory.dmp upx behavioral2/memory/3876-48-0x00000000008B0000-0x0000000000939000-memory.dmp upx behavioral2/memory/5796-49-0x0000000000770000-0x00000000007F9000-memory.dmp upx behavioral2/memory/5796-56-0x0000000000770000-0x00000000007F9000-memory.dmp upx behavioral2/memory/5796-68-0x0000000000770000-0x00000000007F9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\425bc8 bb830e78 File opened for modification C:\Windows\633ac8 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb830e78 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bb830e78 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bb830e78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bb830e78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bb830e78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bb830e78 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bb830e78 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bb830e78 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bb830e78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bb830e78 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3876 bb830e78 3876 bb830e78 3876 bb830e78 3876 bb830e78 3876 bb830e78 3876 bb830e78 3876 bb830e78 3876 bb830e78 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Token: SeTcbPrivilege 5796 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Token: SeDebugPrivilege 3876 bb830e78 Token: SeTcbPrivilege 3876 bb830e78
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe"C:\Users\Admin\AppData\Local\Temp\d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
C:\Windows\Syswow64\bb830e78C:\Windows\Syswow64\bb830e781⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\bb830e78
- Size 1024KB
- SHA256 e44756e1cbf26429294a35413988fd39a63b846f6362c2136d5588caf7725d99
- MD5 175d91ad997cd83e824017784fec0517
- SHA1 3c90ed982d0a3fdd23400a6d343cb20ee0bec55b
- SHA512 6ac7d103b3e88e9d0cb9255b2a9de62f89905ad6e2b57061bd605f4f74d7310ec0edca84185c8c3717e7225799f97853db6ef3bb116a1381c3fd111238969a4c
- SSDEEP 24576:gjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:gTGkQyhuTtS0rQi
- TLSH T10325AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH