Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe
- Size 4.8MB
- Sample260809-117lksel5v
- SHA256 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3
- MD5 683dd2f80a275e3011c7e109be082b3c
- SHA1 3638927488a283619afaff5ee9ae6d1817ad08bf
- SHA512 9988639d87fcc699e248614dc7a7a2d2940bcdc3dde85380efe7f8a541e1ec850851dafc77f5e8116fe0fc9e9716517f4b19c94d1c3484e0b9b63089cbe0aef0
- SSDEEP 49152:HHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:HnKdmWsM0r1QnIK4PKHd0FeS///x
- TLSH T126367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5888 d3a78c59 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe Destination IP 4 223.5.5.5 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe Destination IP 17 114.114.114.114 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe Destination IP 18 223.5.5.5 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d3a78c59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C d3a78c59 File created C:\Windows\SysWOW64\d3a78c59 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d3a78c59 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4d96e8 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe File opened for modification C:\Windows\64ce00 d3a78c59 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3a78c59 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d3a78c59 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d3a78c59 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d3a78c59 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d3a78c59 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d3a78c59 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d3a78c59 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d3a78c59 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d3a78c59 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d3a78c59 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5888 d3a78c59 5888 d3a78c59 5888 d3a78c59 5888 d3a78c59 5888 d3a78c59 5888 d3a78c59 5888 d3a78c59 5888 d3a78c59 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe Token: SeTcbPrivilege 4532 3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe Token: SeDebugPrivilege 5888 d3a78c59 Token: SeTcbPrivilege 5888 d3a78c59
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe"C:\Users\Admin\AppData\Local\Temp\3e5769d324054b63f374f47efdb50c7e33a8c8b0f2d93a5847253824954010d3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
C:\Windows\Syswow64\d3a78c59C:\Windows\Syswow64\d3a78c591⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5888
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d3a78c59
- Size 4.8MB
- SHA256 575955d2929210f06664f77bb325a67595637ad33f1fba5ec1dbd471129fd0c1
- MD5 b1ff6423b23b86d5a9885483d91d1bff
- SHA1 8bb59f309b4559c9b6c591b613c17c331201f1b4
- SHA512 c2ea1794d40289b4b8c95ce9dd742d77d459b5558c608084d1d862bb5aeed9b4f98552455e460a11149260402bc77c079bf7b6bf97a20c2fcebe9f92bfed6cc8
- SSDEEP 49152:RHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:RnKdmWsM0r1QnIK4PKHd0FeS///x
- TLSH T178367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
- MD5 SHA1 SHA512 SSDEEP TLSH