Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 23:17
Behavioral task
behavioral1
Sample
4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe
- Size 761KB
- Sample260823-292blabl6y
- SHA256 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e
- MD5 a4e27588ece4b89fc3a9da1803f89eae
- SHA1 34739a4b041d9aefb10720f2b2df40a75a427c8a
- SHA512 fa0e96f6900158af7c593cce692b8f2a054c5df4e4213e7e75af94243a2afb133f441775718b9c35461f40604cf78ed55cbba7fc926c4e51514b8fda12552433
- SSDEEP 12288:CSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:JvO2xJKRw2kOkxSkW298B
- TLSH T154F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3252 fed6c360 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Destination IP 35 114.114.114.114 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Destination IP 36 223.5.5.5 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Destination IP 82 114.114.114.114 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Destination IP 83 223.5.5.5 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Destination IP 1 114.114.114.114 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\fed6c360 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fed6c360 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fed6c360 -
resource yara_rule behavioral2/memory/1504-0-0x0000000000740000-0x00000000007CC000-memory.dmp upx behavioral2/files/0x000600000001b714-2.dat upx behavioral2/memory/3252-3-0x00000000006D0000-0x000000000075C000-memory.dmp upx behavioral2/memory/1504-16-0x0000000000740000-0x00000000007CC000-memory.dmp upx behavioral2/memory/3252-17-0x00000000006D0000-0x000000000075C000-memory.dmp upx behavioral2/memory/3252-31-0x00000000006D0000-0x000000000075C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\37ace8 fed6c360 File opened for modification C:\Windows\19bfc0 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fed6c360 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fed6c360 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fed6c360 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fed6c360 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fed6c360 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fed6c360 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fed6c360 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fed6c360 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fed6c360 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fed6c360 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3252 fed6c360 3252 fed6c360 3252 fed6c360 3252 fed6c360 3252 fed6c360 3252 fed6c360 3252 fed6c360 3252 fed6c360 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Token: SeTcbPrivilege 1504 4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe Token: SeDebugPrivilege 3252 fed6c360 Token: SeTcbPrivilege 3252 fed6c360
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe"C:\Users\Admin\AppData\Local\Temp\4a4ddd76b6993d3037a327269b24045aed738f79c5697d50eb58f039a277ad4e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
C:\Windows\Syswow64\fed6c360C:\Windows\Syswow64\fed6c3601⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fed6c360
- Size 761KB
- SHA256 da03b048c13f4af153a32ac62fbf4bdd15c23101cbdb1263aa1143117f2f7e3f
- MD5 2076267a1bb0e49d29e8dc53488578fe
- SHA1 cc1291650d374b80a450799f31dd39c8764bccf1
- SHA512 d85007789f7fc91c9bb5f209161d883202424cf33384b87cb3e5767214aea0bb43af9599ff50808f9da21aa611c4044ed92f50f1a3f00bbdebce4017657f7748
- SSDEEP 12288:FSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:kvO2xJKRw2kOkxSkW298B
- TLSH T1D1F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH