Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 01:57
Behavioral task
behavioral1
Sample
3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe
- Size 548KB
- Sample260819-cdncesck7z
- SHA256 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b
- MD5 b7db6f472a87b691c145fbb8e9068b3a
- SHA1 ca114dbcc63dae4af5ba0eee13615dbe7d0c5e08
- SHA512 39be48ad47de06b2c10c80a84348b02037cc1581a8125b293476bddf548fd7973c293a7a2f6359028a77a89012ee77d89dcb37a87be51644ed72e85e540c6267
- SSDEEP 12288:HkbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:EbOgbEqy9RKejHPOwOkx2LF
- TLSH T154C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4700 19cbd06c - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 134 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 205 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 380 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 440 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 441 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 3 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 4 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 132 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 349 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 348 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 44 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 111 114.114.114.114 4700 19cbd06c Destination IP 204 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 276 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 277 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 379 114.114.114.114 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 45 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Destination IP 112 223.5.5.5 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\19cbd06c 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 19cbd06c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 19cbd06c -
resource yara_rule behavioral1/memory/1112-0-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/4700-3-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/files/0x00200000000231d5-2.dat upx behavioral1/memory/1112-16-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/4700-20-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/4700-22-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/4700-26-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/1112-37-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/4700-38-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/1112-41-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/4700-42-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/1112-48-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/1112-49-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/1112-54-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/1112-57-0x0000000000600000-0x0000000000689000-memory.dmp upx behavioral1/memory/1112-61-0x0000000000600000-0x0000000000689000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\507738 19cbd06c File opened for modification C:\Windows\1309b0 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19cbd06c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 19cbd06c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 19cbd06c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 19cbd06c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 19cbd06c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 19cbd06c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 19cbd06c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 19cbd06c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 19cbd06c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 19cbd06c - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4700 19cbd06c 4700 19cbd06c 4700 19cbd06c 4700 19cbd06c 4700 19cbd06c 4700 19cbd06c 4700 19cbd06c 4700 19cbd06c 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Token: SeTcbPrivilege 1112 3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe Token: SeDebugPrivilege 4700 19cbd06c Token: SeTcbPrivilege 4700 19cbd06c
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe"C:\Users\Admin\AppData\Local\Temp\3aa4378eb473f7c1081d1625a1aeb8e9892ab27a43ffe1bb2cf13d15b174e16b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
C:\Windows\Syswow64\19cbd06cC:\Windows\Syswow64\19cbd06c1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\19cbd06c
- Size 548KB
- SHA256 f08ca284f240d6f715592b6b0f0d619d5811de4a9f2bc1039cf5838aac5132f7
- MD5 8d94c22df13260ad77be281215ec3435
- SHA1 efda1678598751bb76e3fb396d68d015b7238300
- SHA512 0e2df09d6bdd2a36e753e6b4f7ce65f6fcdbfe4460f04d1bbf5834653409dec3815150aff915e4f8d11f008fbfe5a233b0f93138b3acaefd0389e1e83463194c
- SSDEEP 12288:ckbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:VbOgbEqy9RKejHPOwOkx2LF
- TLSH T155C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH