Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 02:51
Behavioral task
behavioral1
Sample
73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe
- Size 873KB
- Sample260809-dcn31ayfre
- SHA256 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668
- MD5 a81a2da1517c6a48d2719bcbf75ec594
- SHA1 0dfd48dba2e023f0edcae8f6cba734a97c9de6ad
- SHA512 1eb304767c30f2cd03e5ff2f1e15f0fb4f45adda18ce86bae4079bd5d0f33d47cb784c12b89edf6b8da99a43f9e8eb915349c20d96cdbd659031a587a4b3044b
- SSDEEP 12288:JSvO2x9mONvKRhLSFtsOkx2LIaeyk5FAQjU/Lik8CQ3uEW:wvO2xJKRh2kOkx2LFxNcUQPxW
- TLSH T162156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2072 c6bf4564 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe Destination IP 6 223.5.5.5 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe Destination IP 30 114.114.114.114 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe Destination IP 31 223.5.5.5 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C c6bf4564 File created C:\Windows\SysWOW64\c6bf4564 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c6bf4564 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c6bf4564 -
resource yara_rule behavioral1/memory/4704-0-0x0000000000910000-0x000000000099C000-memory.dmp upx behavioral1/files/0x0034000000016864-2.dat upx behavioral1/memory/2072-3-0x00000000001A0000-0x000000000022C000-memory.dmp upx behavioral1/memory/4704-13-0x0000000000910000-0x000000000099C000-memory.dmp upx behavioral1/memory/2072-14-0x00000000001A0000-0x000000000022C000-memory.dmp upx behavioral1/memory/2072-24-0x00000000001A0000-0x000000000022C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5088c0 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe File opened for modification C:\Windows\237930 c6bf4564 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6bf4564 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c6bf4564 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c6bf4564 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c6bf4564 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c6bf4564 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c6bf4564 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c6bf4564 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c6bf4564 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c6bf4564 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c6bf4564 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2072 c6bf4564 2072 c6bf4564 2072 c6bf4564 2072 c6bf4564 2072 c6bf4564 2072 c6bf4564 2072 c6bf4564 2072 c6bf4564 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe Token: SeTcbPrivilege 4704 73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe Token: SeDebugPrivilege 2072 c6bf4564 Token: SeTcbPrivilege 2072 c6bf4564
Processes
-
C:\Users\Admin\AppData\Local\Temp\73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe"C:\Users\Admin\AppData\Local\Temp\73871894088ebe93bbfa49c7617fba402b779175ec364d04f08f78d7ab883668.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
C:\Windows\Syswow64\c6bf4564C:\Windows\Syswow64\c6bf45641⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c6bf4564
- Size 873KB
- SHA256 96621b17ce1c09362db9913e939a6f05c196ade7db90b8f0c3aae6cb43b62874
- MD5 020bb1496a97813615f42e902deeaede
- SHA1 ff503697395dff859becd95b2eaf6e8c462a5140
- SHA512 c950ee565db9405c73c595d7f8c6ade0a9d78a922abfdfe7081173db2147cbcd188699bfac8186c1d887e2bb399d5dbd349d241b4e810ef8cfec3c062001f1e7
- SSDEEP 12288:WSvO2x9mONvKRhLSFtsOkx2LIaeyk5FAQjU/Lik8CQ3uEW:VvO2xJKRh2kOkx2LFxNcUQPxW
- TLSH T121156B31E641C036D0A34576C6FA4BBFE964BD25531165CBA3D43A262FB32D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH