Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 22:11
Behavioral task
behavioral1
Sample
fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe
- Size 1.1MB
- Sample260810-138awszdkf
- SHA256 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2
- MD5 8d7c8783fc0cb1c4b56984be11a2cf22
- SHA1 a5a01be2e9f16a5586bb334ba656c5267c61ed23
- SHA512 ab4aad61f3cbcc0af18a75260d88fc54467c008e72a9b7d21e3902622b3d0fd190064c9af80f7622eb75c05427e85c034422a7da9bd2fc39b0afece916e06891
- SSDEEP 12288:pSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:QvO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T1F0357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4600 59e66162 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe Destination IP 5 223.5.5.5 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe Destination IP 34 114.114.114.114 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe Destination IP 35 223.5.5.5 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 59e66162 File created C:\Windows\SysWOW64\59e66162 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 59e66162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 59e66162 -
resource yara_rule behavioral1/memory/3912-0-0x0000000000680000-0x000000000070C000-memory.dmp upx behavioral1/files/0x000500000001690d-2.dat upx behavioral1/memory/4600-4-0x00000000008C0000-0x000000000094C000-memory.dmp upx behavioral1/memory/3912-12-0x0000000000680000-0x000000000070C000-memory.dmp upx behavioral1/memory/4600-13-0x00000000008C0000-0x000000000094C000-memory.dmp upx behavioral1/memory/4600-24-0x00000000008C0000-0x000000000094C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\42f990 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe File opened for modification C:\Windows\4ec0f0 59e66162 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59e66162 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 59e66162 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 59e66162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 59e66162 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 59e66162 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 59e66162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 59e66162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 59e66162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 59e66162 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 59e66162 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 4600 59e66162 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe Token: SeTcbPrivilege 3912 fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe Token: SeDebugPrivilege 4600 59e66162 Token: SeTcbPrivilege 4600 59e66162
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe"C:\Users\Admin\AppData\Local\Temp\fd352c0c8e528bb232a88fd696e488020f02852138b7d5bfc4b02a98859a9ec2.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
C:\Windows\Syswow64\59e66162C:\Windows\Syswow64\59e661621⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4ec0f0
- Size 506B
- SHA256 dec081b6a5c4ab3b77f1bcb62e6152726aacbbad9c7745b7b7f6a41055e4d7fa
- MD5 9cd59085e569e24ffdc256e714c46a4c
- SHA1 f9bee659965c5d9986f9b179d996a166b7d8893b
- SHA512 84d3d52ad7b62549879066e49c701f4fc0c4ff831b1300955aa7afdefe096843afdd848b95777bb42cfe426ead7c2312952cadf7edf89a475247fab8a97ddb10
- TLSH T1E8F007FEC4332AF04A9EACB72A2BBA956E0BE03F1107A0A538D33DC101C3583880300C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\59e66162
- Size 1.1MB
- SHA256 213d702436dc82fdd05c4d846a9833b6a52a8b99fd1edc1a03cc8c6b77d8f01a
- MD5 39bc6aee8c6c35367fb7d40e5fde7878
- SHA1 e5034130cb399f3f41b2ece2c66e0b2cf139ef8a
- SHA512 dafafbeedde47402b1407336095226fa9a5f616cab62563b97a238c1f9f3608dbe56d06beb2617b23d59ab070aadcbef49cfb68fe1cbf457106251da694ec120
- SSDEEP 12288:gSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:7vO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T19B357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH