Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 04:11
Behavioral task
behavioral1
Sample
ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe
- Size 560KB
- Sample260818-esd4eawbmd
- SHA256 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5
- MD5 b5bde4adca3940807dfc2cefe29c1387
- SHA1 3eb4a971546f8b8472aee52eff48160d3534698f
- SHA512 fbca90e5dfba0d0f657d76d2d3736ac5b58f3994afd69f898ac795f842742c69dac46e7677c30b2f71845695c0526d608927de71b418acfe6e83d5f702c1cf1f
- SSDEEP 6144:04ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:0rNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T1F0C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2396 6c5e83be - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 136 114.114.114.114 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 199 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 367 114.114.114.114 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 403 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 3 114.114.114.114 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 68 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 160 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 302 114.114.114.114 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 4 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 67 114.114.114.114 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 368 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 402 114.114.114.114 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 137 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 151 114.114.114.114 2396 6c5e83be Destination IP 197 114.114.114.114 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Destination IP 308 223.5.5.5 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6c5e83be File created C:\Windows\SysWOW64\6c5e83be ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 6c5e83be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 6c5e83be -
resource yara_rule behavioral1/memory/4176-0-0x0000000000DD0000-0x0000000000E5C000-memory.dmp upx behavioral1/files/0x00120000000243ce-2.dat upx behavioral1/memory/2396-4-0x0000000000270000-0x00000000002FC000-memory.dmp upx behavioral1/memory/4176-18-0x0000000000DD0000-0x0000000000E5C000-memory.dmp upx behavioral1/memory/2396-19-0x0000000000270000-0x00000000002FC000-memory.dmp upx behavioral1/memory/2396-36-0x0000000000270000-0x00000000002FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\290538 6c5e83be File opened for modification C:\Windows\477ea0 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c5e83be - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 6c5e83be Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 6c5e83be Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 6c5e83be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 6c5e83be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 6c5e83be Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 6c5e83be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 6c5e83be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 6c5e83be Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 6c5e83be - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 2396 6c5e83be 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Token: SeTcbPrivilege 4176 ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe Token: SeDebugPrivilege 2396 6c5e83be Token: SeTcbPrivilege 2396 6c5e83be
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe"C:\Users\Admin\AppData\Local\Temp\ccad625aba720e102e1db1b4045131c1a6a1466ae2a36db33d06bf735381a3e5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
C:\Windows\Syswow64\6c5e83beC:\Windows\Syswow64\6c5e83be1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\290538
- Size 506B
- SHA256 3c37097f239e2d25a89923fd57e5dac096dfb4979c16c562e5a57c93b2da42d8
- MD5 ede381baf9b83c46d42e6036fb5ec504
- SHA1 4d9f2ebca9e523244dd5fa765c7508028c04e330
- SHA512 eca1f54312cafcd4a13ac221e1ddda4e05694f880a2bf02064ab86ab7fd602f898b72801fae30c0067a2387d40947931300481ed06985742bbe78c1193d9d078
- TLSH T1A7F00579DC5F7DB985EDA639DD263842507C712E48C565211AD0B4E5088303BB907887
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\6c5e83be
- Size 560KB
- SHA256 e4310a6324109977433226b16eb76557d86c5d8de29d7f0b341126b2fad73ec2
- MD5 a5f3d1ab1311aeb7c388b8f208ebb65d
- SHA1 5797bdcc0b0ec6b4fc5f07418061b09446f84d70
- SHA512 8f2da500b3cc3523fcbd3ba967e8b60af28a347277e4f80dc16db4863ed6b4f5fe7e17455651daee51989319bfa0082f35190ed67dd3da293802ca0033238ecc
- SSDEEP 6144:B4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:BrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T118C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH