Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 07:27
Behavioral task
behavioral1
Sample
6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe
- Size 1.1MB
- Sample260819-jadgdafm71
- SHA256 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c
- MD5 a9d8ef9172e0dc1dbdba0075c54c0a33
- SHA1 a66e2134e69f68a3dda37fff7111095e532ef680
- SHA512 9fe60fbdd62d96c1edb033ea2e798b77993c04c216a1fcc7c83704d7b4a4c4f094321b8e7cae0f34f4e81ed1db5011038ccbc07af25d89c0237951530c4d2b26
- SSDEEP 12288:ySvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:ZvO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T1B1357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4432 8f431db2 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe Destination IP 18 114.114.114.114 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe Destination IP 19 223.5.5.5 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe Destination IP 1 114.114.114.114 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8f431db2 File created C:\Windows\SysWOW64\8f431db2 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8f431db2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8f431db2 -
resource yara_rule behavioral2/memory/3552-0-0x00000000008B0000-0x000000000093C000-memory.dmp upx behavioral2/files/0x000e00000001b859-2.dat upx behavioral2/memory/4432-3-0x0000000000A70000-0x0000000000AFC000-memory.dmp upx behavioral2/memory/3552-17-0x00000000008B0000-0x000000000093C000-memory.dmp upx behavioral2/memory/4432-18-0x0000000000A70000-0x0000000000AFC000-memory.dmp upx behavioral2/memory/4432-40-0x0000000000A70000-0x0000000000AFC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4be0a0 8f431db2 File opened for modification C:\Windows\3ccfc0 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f431db2 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8f431db2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8f431db2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8f431db2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8f431db2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8f431db2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8f431db2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8f431db2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8f431db2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8f431db2 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 4432 8f431db2 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe Token: SeTcbPrivilege 3552 6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe Token: SeDebugPrivilege 4432 8f431db2 Token: SeTcbPrivilege 4432 8f431db2
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe"C:\Users\Admin\AppData\Local\Temp\6cace9c01843b46057b2edcfbd5003d2d6f1e47742b04eae8c57cd74722aca2c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
C:\Windows\Syswow64\8f431db2C:\Windows\Syswow64\8f431db21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4be0a0
- Size 916B
- SHA256 344b3c3e7311406d9c68a2d08d405ab70d68bf55596a91111d5d1a225d3011da
- MD5 bad16a4a1921a4e10f59be0dd8a024a9
- SHA1 583e03f3f6f66decf8aabc54fee196d6fbb68a8b
- SHA512 b263c2ab360c07658e96c9f8f1a02a3114eddf8abcfd9d870596298021367b5140b6bde3e4e0edb8a13fde55d8793f5868b6aa53e2811840803f97500bb941f8
- TLSH T15C11597294A6D3E29CA1416235E7ADFD7BB3359FC4CD421B089398601323BDDC621482
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\8f431db2
- Size 1.1MB
- SHA256 325edfaa6c2cb9ab95add442e4ef6b36d034884ccaef95b598217357fc96cdb1
- MD5 28fd5554c16e98ad6d8c3ebc2783144b
- SHA1 b25819c5dc8e9198367c84a90def00e6ffee940a
- SHA512 0182d17fe000c33762d1a3241576789c7c12e71adc5fd8fcbac3b06709fee959eccc2abc1075eb2fee2df5b745aa47eb63b46654bddabdef727cd3b844c0c14a
- SSDEEP 12288:8SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:PvO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T180357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH