Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 21:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe
- Size 3.0MB
- Sample260810-1dk43ayfnd
- SHA256 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf
- MD5 81b2c93df3f95a04ab0228f04d991da0
- SHA1 a970eb1baba7885d10819790dc0b04f3cc0dacdb
- SHA512 2d2bdde98a29494447d764a587af7ef5b23040af04466143366664db194c5edc62a62e2db3adaf40d6cc446d9d451261c9074f7d672f47f2de80e4890fc94260
- SSDEEP 49152:QHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:QnKdBWsM0r1Qn1K4XKH40Feq
- TLSH T10FE59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 668 be01c5ef - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 98 223.5.5.5 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Destination IP 3 114.114.114.114 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Destination IP 4 223.5.5.5 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Destination IP 39 114.114.114.114 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Destination IP 40 223.5.5.5 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Destination IP 97 114.114.114.114 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C be01c5ef File created C:\Windows\SysWOW64\be01c5ef b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C be01c5ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 be01c5ef - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4a8200 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe File opened for modification C:\Windows\b6fb8 be01c5ef - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be01c5ef - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" be01c5ef Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" be01c5ef Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" be01c5ef Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing be01c5ef Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" be01c5ef Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" be01c5ef Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ be01c5ef Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" be01c5ef Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix be01c5ef - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 668 be01c5ef 668 be01c5ef 668 be01c5ef 668 be01c5ef 668 be01c5ef 668 be01c5ef 668 be01c5ef 668 be01c5ef 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Token: SeTcbPrivilege 4352 b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe Token: SeDebugPrivilege 668 be01c5ef Token: SeTcbPrivilege 668 be01c5ef
Processes
-
C:\Users\Admin\AppData\Local\Temp\b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe"C:\Users\Admin\AppData\Local\Temp\b02eb76789e8621201b1f7593395d08e7f9027570cfd3d6fc712f3f9b3211baf.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
C:\Windows\Syswow64\be01c5efC:\Windows\Syswow64\be01c5ef1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\be01c5ef
- Size 3.0MB
- SHA256 eb2d70a19da64272bad67c3ee25d81d0533188604ebbf10a0aa1269f62130109
- MD5 999be01d21ae622b7569a2d77d101be5
- SHA1 d4b74c8fecc5782da9e2c48da82ab7861cc9c2ba
- SHA512 becb800e2ae3f2948b361923720d84eb7449c97c9e0b985b07e61db5d2353d10de466cad81b445c065424798ab200d2cc6b3d76bf438e47efd5592fc04494200
- SSDEEP 49152:0HHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:0nKdBWsM0r1Qn1K4XKH40Feq
- TLSH T12CE59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH