Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 00:01
Behavioral task
behavioral1
Sample
3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe
- Size 1.4MB
- Sample260813-aax2cavyfz
- SHA256 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1
- MD5 a355344f4f3b319202c3095e60d7d908
- SHA1 8b72f984460eec0b34ccfa4e476543a46284f31e
- SHA512 ad88a564af9acf6b553e4a79daff560afd69b033c3bcb72b62256d37bf29601fe598e273f2f47579cc810eaac8e87a085c482d92cb9cbbe70364f03de81e167e
- SSDEEP 24576:6jHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:6TGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T111658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3308 db885570 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe Destination IP 13 114.114.114.114 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe Destination IP 16 223.5.5.5 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe Destination IP 1 114.114.114.114 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 db885570 File created C:\Windows\SysWOW64\db885570 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE db885570 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 db885570 -
resource yara_rule behavioral2/memory/2516-0-0x0000000000D40000-0x0000000000DC9000-memory.dmp upx behavioral2/memory/3308-3-0x0000000000A20000-0x0000000000AA9000-memory.dmp upx behavioral2/files/0x0007000000016cf8-2.dat upx behavioral2/memory/2516-12-0x0000000000D40000-0x0000000000DC9000-memory.dmp upx behavioral2/memory/3308-14-0x0000000000A20000-0x0000000000AA9000-memory.dmp upx behavioral2/memory/2516-36-0x0000000000D40000-0x0000000000DC9000-memory.dmp upx behavioral2/memory/3308-37-0x0000000000A20000-0x0000000000AA9000-memory.dmp upx behavioral2/memory/2516-53-0x0000000000D40000-0x0000000000DC9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\38a258 db885570 File opened for modification C:\Windows\2b1328 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db885570 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix db885570 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" db885570 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" db885570 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" db885570 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing db885570 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" db885570 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ db885570 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" db885570 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" db885570 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3308 db885570 3308 db885570 3308 db885570 3308 db885570 3308 db885570 3308 db885570 3308 db885570 3308 db885570 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe Token: SeTcbPrivilege 2516 3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe Token: SeDebugPrivilege 3308 db885570 Token: SeTcbPrivilege 3308 db885570
Processes
-
C:\Users\Admin\AppData\Local\Temp\3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe"C:\Users\Admin\AppData\Local\Temp\3211478965170725ea7694c21f45db64bac71f144fade0df728e2c62ba2e79f1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
C:\Windows\Syswow64\db885570C:\Windows\Syswow64\db8855701⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\db885570
- Size 1.4MB
- SHA256 378143fe4a94856fd206e7afe325f5a91b5f4d8aa7ebf61496588314fcbf4be6
- MD5 83061a973963757f575bb3efe655f706
- SHA1 ded82c017d8ec9333901c87aa00baae65218391b
- SHA512 dc75ba1c163c07e9bc01e1509102d50afef98c71a4828121d866f11cb5469b89614f9f2fb7f4d7e747a34c727ea7a073d45581032374c812f4a99c06210cd493
- SSDEEP 24576:LjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:LTGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T1D2658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH