Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 02:48
Behavioral task
behavioral1
Sample
6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe
- Size 2.5MB
- Sample260818-das9yafa69
- SHA256 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39
- MD5 1d1fc0dfbb687afd63624fe85b71d730
- SHA1 dcd1dd55d21da019e95b8b04560a9af1eb70b142
- SHA512 dcd844aac79fd81e85b444f78bd26a76bd78399081062add0d1e3265636f2ff344ff65fffe7ef9a87c76e75e1297c0c8e1fb180d6b88ebc4373af0990034a403
- SSDEEP 49152:LHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:LnKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T125C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 6040 e31329a4 - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 118 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 84 114.114.114.114 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 109 114.114.114.114 6040 e31329a4 Destination IP 140 114.114.114.114 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 234 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 319 114.114.114.114 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 3 114.114.114.114 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 141 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 233 114.114.114.114 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 289 114.114.114.114 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 320 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 4 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 40 114.114.114.114 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 290 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 41 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Destination IP 86 223.5.5.5 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e31329a4 File created C:\Windows\SysWOW64\e31329a4 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e31329a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e31329a4 -
resource yara_rule behavioral2/memory/1440-0-0x00000000001A0000-0x000000000022C000-memory.dmp upx behavioral2/files/0x000800000001b83c-2.dat upx behavioral2/memory/6040-3-0x00000000008B0000-0x000000000093C000-memory.dmp upx behavioral2/memory/1440-16-0x00000000001A0000-0x000000000022C000-memory.dmp upx behavioral2/memory/6040-17-0x00000000008B0000-0x000000000093C000-memory.dmp upx behavioral2/memory/6040-38-0x00000000008B0000-0x000000000093C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\676830 e31329a4 File opened for modification C:\Windows\18a740 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e31329a4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e31329a4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e31329a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e31329a4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e31329a4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e31329a4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e31329a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e31329a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e31329a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e31329a4 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 6040 e31329a4 6040 e31329a4 6040 e31329a4 6040 e31329a4 6040 e31329a4 6040 e31329a4 6040 e31329a4 6040 e31329a4 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Token: SeTcbPrivilege 1440 6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe Token: SeDebugPrivilege 6040 e31329a4 Token: SeTcbPrivilege 6040 e31329a4
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe"C:\Users\Admin\AppData\Local\Temp\6c9b23ffff7f76b4d44f57a575c471dff4dd29e8a6c9902b2781bc8fad6e9d39.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
C:\Windows\Syswow64\e31329a4C:\Windows\Syswow64\e31329a41⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6040
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e31329a4
- Size 2.5MB
- SHA256 26a0aee8f833a37facc60972893b8a3be7079e564af3df962b5fdc329a4e0535
- MD5 96c33804f1fd87d57acd139633b155ce
- SHA1 9058d948a5be3ffc484843eb7bdcdc62a3571770
- SHA512 6f6f7407839fd49dfd36d857326dc078242e1fb8b7782bfd9d3721f7a9ecff7c44af9fd5fe60e1ef25886878c1349bf24cd3d399568a0bd5eb036b78c8265f04
- SSDEEP 49152:mHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:mnKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T122C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH