Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 00:55
Behavioral task
behavioral1
Sample
57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe
- Size 576KB
- Sample260818-a949pstwe1
- SHA256 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f
- MD5 1ece300b91410f1c67b5be2183413ef4
- SHA1 2c0b8cf4367fac3016db8be15b51de7094812a9f
- SHA512 4dba6907d6e1111ca5f8c2e17c0f9f4c92d11bff21376209d5f4a9b650bb04d5d3c7040612f90332530845914d015e5fec83d16cad639a43ddff0df791a9e762
- SSDEEP 12288:AqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:AjHPOSOkx2LFscUQPK
- TLSH T103C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2356 d3e8501f - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 293 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 1 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 40 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 93 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 145 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 237 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 292 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 91 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 235 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 376 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 3 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 100 114.114.114.114 2356 d3e8501f Destination IP 322 114.114.114.114 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 377 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 41 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 110 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 147 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Destination IP 323 223.5.5.5 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d3e8501f File created C:\Windows\SysWOW64\d3e8501f 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d3e8501f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d3e8501f -
resource yara_rule behavioral2/memory/1624-0-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/files/0x0007000000016cf1-2.dat upx behavioral2/memory/2356-3-0x0000000000FB0000-0x0000000001039000-memory.dmp upx behavioral2/memory/1624-16-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/2356-18-0x0000000000FB0000-0x0000000001039000-memory.dmp upx behavioral2/memory/2356-19-0x0000000000FB0000-0x0000000001039000-memory.dmp upx behavioral2/memory/1624-42-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/2356-43-0x0000000000FB0000-0x0000000001039000-memory.dmp upx behavioral2/memory/1624-46-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/2356-47-0x0000000000FB0000-0x0000000001039000-memory.dmp upx behavioral2/memory/2356-49-0x0000000000FB0000-0x0000000001039000-memory.dmp upx behavioral2/memory/1624-53-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/1624-55-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/1624-60-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2855e8 d3e8501f File opened for modification C:\Windows\1bcdb0 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3e8501f - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d3e8501f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d3e8501f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d3e8501f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d3e8501f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d3e8501f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d3e8501f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d3e8501f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d3e8501f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d3e8501f - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2356 d3e8501f 2356 d3e8501f 2356 d3e8501f 2356 d3e8501f 2356 d3e8501f 2356 d3e8501f 2356 d3e8501f 2356 d3e8501f 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Token: SeTcbPrivilege 1624 57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe Token: SeDebugPrivilege 2356 d3e8501f Token: SeTcbPrivilege 2356 d3e8501f
Processes
-
C:\Users\Admin\AppData\Local\Temp\57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe"C:\Users\Admin\AppData\Local\Temp\57c9d8819f92a5bfb9067b86b72c43c94599520fed34a53a601233fe66a6520f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
C:\Windows\Syswow64\d3e8501fC:\Windows\Syswow64\d3e8501f1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d3e8501f
- Size 576KB
- SHA256 7f612e0fc2c1fba33a92a0e868eb75f76829a48e5e3be403e28dc5a4fc986569
- MD5 cc087700b9989ea3e4106c9c5899ef20
- SHA1 512118ec923b1bd6f0cb8de278b4e53a34f6ac40
- SHA512 e21da1c53451212d7a8fa26c32b1fb382a84c75123f34d894b4f3c565dc04d3029c1f2ff040a7bf86f6e02771902289850a7b0065db5603f2e2cb79c7eae49e2
- SSDEEP 12288:sqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:sjHPOSOkx2LFscUQPK
- TLSH T105C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH