Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 23:10
Behavioral task
behavioral1
Sample
970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe
- Size 560KB
- Sample260823-25n6gabl21
- SHA256 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe
- MD5 57f76787851c9f8d9da954afe97a6137
- SHA1 352906fa4a3aaa943a608f8a65f5d86c937c22c3
- SHA512 48a1b6136a278b6f8a84f585dfdfca97ae028d7323670b99de9c820b0ccf5062c82eaab10da9d9a3e6e2ee17bdd65a9f054d4923c591a1a45114c49b9a4ddab6
- SSDEEP 6144:Cgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:CI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T14DC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2136 535955fd - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 159 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 309 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 405 114.114.114.114 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 136 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 197 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 374 114.114.114.114 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 375 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 3 114.114.114.114 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 150 114.114.114.114 2136 535955fd Destination IP 302 114.114.114.114 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 4 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 195 114.114.114.114 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 406 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 70 114.114.114.114 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 71 223.5.5.5 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 134 114.114.114.114 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 535955fd File created C:\Windows\SysWOW64\535955fd 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 535955fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 535955fd -
resource yara_rule behavioral1/memory/3644-0-0x0000000000510000-0x000000000059C000-memory.dmp upx behavioral1/files/0x001c0000000243fa-2.dat upx behavioral1/memory/2136-3-0x0000000000070000-0x00000000000FC000-memory.dmp upx behavioral1/memory/3644-16-0x0000000000510000-0x000000000059C000-memory.dmp upx behavioral1/memory/2136-17-0x0000000000070000-0x00000000000FC000-memory.dmp upx behavioral1/memory/2136-34-0x0000000000070000-0x00000000000FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2491b0 535955fd File opened for modification C:\Windows\3e62f8 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 535955fd - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 535955fd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 535955fd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 535955fd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 535955fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 535955fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 535955fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 535955fd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 535955fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 535955fd - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2136 535955fd 2136 535955fd 2136 535955fd 2136 535955fd 2136 535955fd 2136 535955fd 2136 535955fd 2136 535955fd 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Token: SeTcbPrivilege 3644 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Token: SeDebugPrivilege 2136 535955fd Token: SeTcbPrivilege 2136 535955fd
Processes
-
C:\Users\Admin\AppData\Local\Temp\970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe"C:\Users\Admin\AppData\Local\Temp\970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
C:\Windows\Syswow64\535955fdC:\Windows\Syswow64\535955fd1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\535955fd
- Size 560KB
- SHA256 d2051d1d9f47ef1b0cfa73bf3178b06d12653aa0e994e58e9307da70ac6718d0
- MD5 b66e38a018ff1b71e3d153753b2bfc75
- SHA1 af01f6b6f68023a47bb3b4f7da52831852d7eaf4
- SHA512 f4edba72ea3fbebf53500796396e1d4531612ea2a2083f73a489fabdf262cec9996af61522425d59e298a768ddfad673132afd48dd8d4ce17db73f503c05a1b1
- SSDEEP 6144:Kgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:KI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T1CFC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA7D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH