Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 22:02
Behavioral task
behavioral1
Sample
18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe
- Size 2.5MB
- Sample260809-1x8dpscf89
- SHA256 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0
- MD5 fd33d8b3e67b12b416e9a05ddca8b498
- SHA1 963d5cf8d8c348bcd037872609d56e1f3969e9fd
- SHA512 2eb4f9b09954abdc820811c96236c9f8300f2ea8d0e3149ae2b025546d691d290dce589ff58282815126c53d2275c91866586dceec7bfef87e3c662780e60885
- SSDEEP 49152:aHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:anKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T16FC58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5104 4cb4d1a6 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe Destination IP 2 223.5.5.5 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe Destination IP 22 114.114.114.114 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe Destination IP 23 223.5.5.5 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 4cb4d1a6 File created C:\Windows\SysWOW64\4cb4d1a6 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 4cb4d1a6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 4cb4d1a6 -
resource yara_rule behavioral2/memory/3744-0-0x0000000000B80000-0x0000000000C0C000-memory.dmp upx behavioral2/files/0x0008000000019cb5-2.dat upx behavioral2/memory/5104-3-0x0000000000980000-0x0000000000A0C000-memory.dmp upx behavioral2/memory/3744-18-0x0000000000B80000-0x0000000000C0C000-memory.dmp upx behavioral2/memory/5104-19-0x0000000000980000-0x0000000000A0C000-memory.dmp upx behavioral2/memory/5104-36-0x0000000000980000-0x0000000000A0C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5761e0 4cb4d1a6 File opened for modification C:\Windows\401940 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4cb4d1a6 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 4cb4d1a6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 4cb4d1a6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 4cb4d1a6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 4cb4d1a6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 4cb4d1a6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 4cb4d1a6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 4cb4d1a6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 4cb4d1a6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 4cb4d1a6 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5104 4cb4d1a6 5104 4cb4d1a6 5104 4cb4d1a6 5104 4cb4d1a6 5104 4cb4d1a6 5104 4cb4d1a6 5104 4cb4d1a6 5104 4cb4d1a6 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe Token: SeTcbPrivilege 3744 18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe Token: SeDebugPrivilege 5104 4cb4d1a6 Token: SeTcbPrivilege 5104 4cb4d1a6
Processes
-
C:\Users\Admin\AppData\Local\Temp\18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe"C:\Users\Admin\AppData\Local\Temp\18b34ca9629ed2ceb1b8df3454790e201ff325fa93ad3b7b91aeaa21348282f0.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
C:\Windows\Syswow64\4cb4d1a6C:\Windows\Syswow64\4cb4d1a61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\4cb4d1a6
- Size 2.5MB
- SHA256 9171302e5a6cf35272ce5e2f8d01d5c10182a589a8f20da65130c1f4f9fac218
- MD5 fc72b1707851f7b8702db2c5510f0e1d
- SHA1 beac62451644c37f7f5ca2d6c33e51689ced135c
- SHA512 92d736d1664073ba6961b3b869d1d5948dd1f9dfda0f4c07ccdd4bc1ffca80f6f05adf4b0bbf014ff93be3f45c390d0c9c5dbbc37819a4bf76aba6dcc43f9cdf
- SSDEEP 49152:yHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:ynKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T194C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH