Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 23:22
Behavioral task
behavioral1
Sample
c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe
- Size 576KB
- Sample260823-3cy1msbe38
- SHA256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5
- MD5 564af9060ec8b06db0061d0fd3ed8521
- SHA1 84693b8a7591eddc7b900ff4e0527317acdbff1c
- SHA512 9fd1459ba4a6773ee07c48ccdc5cc9e0f04fc00b03f773aab9e9a5c1449fcf6e375f9d9bb63013e711e47aabd79d0bbda5a2beb2a4ffbe0f95f0c75842203758
- SSDEEP 6144:fcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:fSvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T15AC46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 724 acd377c2 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 159 114.114.114.114 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 160 223.5.5.5 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 1 114.114.114.114 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 2 223.5.5.5 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 35 114.114.114.114 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 36 114.114.114.114 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 37 223.5.5.5 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 40 223.5.5.5 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 102 114.114.114.114 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Destination IP 103 223.5.5.5 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 acd377c2 File created C:\Windows\SysWOW64\acd377c2 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE acd377c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies acd377c2 -
resource yara_rule behavioral2/memory/4256-0-0x0000000000BC0000-0x0000000000C4C000-memory.dmp upx behavioral2/files/0x000600000001b6f0-2.dat upx behavioral2/memory/724-3-0x0000000000C40000-0x0000000000CCC000-memory.dmp upx behavioral2/memory/4256-18-0x0000000000BC0000-0x0000000000C4C000-memory.dmp upx behavioral2/memory/724-19-0x0000000000C40000-0x0000000000CCC000-memory.dmp upx behavioral2/memory/724-36-0x0000000000C40000-0x0000000000CCC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\c6528 acd377c2 File opened for modification C:\Windows\48dd40 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acd377c2 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" acd377c2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ acd377c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" acd377c2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" acd377c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" acd377c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" acd377c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" acd377c2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing acd377c2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix acd377c2 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 724 acd377c2 724 acd377c2 724 acd377c2 724 acd377c2 724 acd377c2 724 acd377c2 724 acd377c2 724 acd377c2 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Token: SeTcbPrivilege 4256 c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe Token: SeDebugPrivilege 724 acd377c2 Token: SeTcbPrivilege 724 acd377c2
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe"C:\Users\Admin\AppData\Local\Temp\c4a441cf03bf203c6ee21075aef3664f7b0aadebd0fcb278fd913afade8ffed5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
C:\Windows\Syswow64\acd377c2C:\Windows\Syswow64\acd377c21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\acd377c2
- Size 576KB
- SHA256 b0189ed342c07c2220925b42040ef909f49ed69d49939120e0d42f1f135023f0
- MD5 756426343dfa6092a6d3aa2dcc5023ce
- SHA1 61b91db7bc16ccd3fec773ed2f1b80ef4afcb844
- SHA512 bdc7f33e429af1d8a9f92ec2f08cff4bdf0f04ccee0cf0a7ed7cc00d01e896fe5b65db22d7a1285ff605ab052ef94f2e2fcb817b71f13b828e629577e4017910
- SSDEEP 6144:UcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:USvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T142C46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH