Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 22:48
Behavioral task
behavioral1
Sample
4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe
- Size 766KB
- Sample260818-2rfbeatwgs
- SHA256 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129
- MD5 4c88892bed83e63e76917ab37d3dbddc
- SHA1 5b99763a315393c84446a5a8a6a078d120902e03
- SHA512 4186e5f31e27aa7b49c195cc97a37489eb63e7cc4d5fea384ccc92d94184268ec9327db4bb504016d42adc9e0974c64954f1a9d7756506e307c7d55706e50346
- SSDEEP 12288:BSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:IvO2xJKRw2kOkx2LFRvcUV
- TLSH T1CCF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4516 45ce94e6 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 235 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 323 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 41 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 293 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 376 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 1 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 2 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 165 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 167 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 292 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 40 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 95 114.114.114.114 4516 45ce94e6 Destination IP 103 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 236 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 322 114.114.114.114 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 377 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 96 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Destination IP 104 223.5.5.5 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\45ce94e6 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 45ce94e6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 45ce94e6 -
resource yara_rule behavioral2/memory/4144-0-0x0000000000BA0000-0x0000000000C2C000-memory.dmp upx behavioral2/files/0x000700000001b85f-2.dat upx behavioral2/memory/4516-3-0x0000000001000000-0x000000000108C000-memory.dmp upx behavioral2/memory/4144-16-0x0000000000BA0000-0x0000000000C2C000-memory.dmp upx behavioral2/memory/4516-17-0x0000000001000000-0x000000000108C000-memory.dmp upx behavioral2/memory/4516-40-0x0000000001000000-0x000000000108C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4d50c8 45ce94e6 File opened for modification C:\Windows\46f260 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45ce94e6 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 45ce94e6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 45ce94e6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 45ce94e6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 45ce94e6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 45ce94e6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 45ce94e6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 45ce94e6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 45ce94e6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 45ce94e6 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4516 45ce94e6 4516 45ce94e6 4516 45ce94e6 4516 45ce94e6 4516 45ce94e6 4516 45ce94e6 4516 45ce94e6 4516 45ce94e6 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Token: SeTcbPrivilege 4144 4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe Token: SeDebugPrivilege 4516 45ce94e6 Token: SeTcbPrivilege 4516 45ce94e6
Processes
-
C:\Users\Admin\AppData\Local\Temp\4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe"C:\Users\Admin\AppData\Local\Temp\4692fdc913eda836d7e2fd50b2646f52f31f8e91e5d41df525ab99c774055129.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
C:\Windows\Syswow64\45ce94e6C:\Windows\Syswow64\45ce94e61⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\45ce94e6
- Size 766KB
- SHA256 579f232f9a3540d7b8f611de45ff136579380552ce4ffdb21820f11749b8d974
- MD5 52b44cde658d036ca735a06c128bff6e
- SHA1 f445c96a49f3c7c480f661fdcabb04d77941fc0f
- SHA512 4f2a03ec35dc905fe39805137526bb62413276e532f49f86cb6a053eebd7bd274972a7fcacdc1e493a0307de4a410206376682640c0dc50f4f8b97fe08e117b9
- SSDEEP 12288:jSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:WvO2xJKRw2kOkx2LFRvcUV
- TLSH T12BF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH