Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 23:26
Behavioral task
behavioral1
Sample
d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe
- Size 2.5MB
- Sample260823-3e2vbawwds
- SHA256 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6
- MD5 73332fe6f41349bd25e85b0b33a8e29b
- SHA1 072c589bcb5439095ca963f14b1052882633afeb
- SHA512 9c8bfbd01e884c36c1cdead27eb75613ca29ea89771c6c6d14a2839cbcb85e136cc8b14ab58f070273f562c8dac5e4990d4ffdff52f7ec79062262d50c742340
- SSDEEP 49152:THHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:TnKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T145C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1800 f530fbf4 - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 36 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 131 114.114.114.114 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 279 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 309 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 1 114.114.114.114 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 75 114.114.114.114 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 132 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 223 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 278 114.114.114.114 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 308 114.114.114.114 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 116 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 222 114.114.114.114 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 35 114.114.114.114 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 76 223.5.5.5 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Destination IP 109 114.114.114.114 1800 f530fbf4 - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f530fbf4 File created C:\Windows\SysWOW64\f530fbf4 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f530fbf4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f530fbf4 -
resource yara_rule behavioral2/memory/1944-0-0x0000000000A80000-0x0000000000B0C000-memory.dmp upx behavioral2/files/0x000800000001b83c-2.dat upx behavioral2/memory/1800-4-0x0000000000550000-0x00000000005DC000-memory.dmp upx behavioral2/memory/1944-18-0x0000000000A80000-0x0000000000B0C000-memory.dmp upx behavioral2/memory/1800-19-0x0000000000550000-0x00000000005DC000-memory.dmp upx behavioral2/memory/1800-40-0x0000000000550000-0x00000000005DC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1ed110 f530fbf4 File opened for modification C:\Windows\214830 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f530fbf4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f530fbf4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f530fbf4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f530fbf4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f530fbf4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f530fbf4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f530fbf4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f530fbf4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f530fbf4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f530fbf4 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1800 f530fbf4 1800 f530fbf4 1800 f530fbf4 1800 f530fbf4 1800 f530fbf4 1800 f530fbf4 1800 f530fbf4 1800 f530fbf4 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Token: SeTcbPrivilege 1944 d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe Token: SeDebugPrivilege 1800 f530fbf4 Token: SeTcbPrivilege 1800 f530fbf4
Processes
-
C:\Users\Admin\AppData\Local\Temp\d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe"C:\Users\Admin\AppData\Local\Temp\d99e8ef41b523c0bd8975b766d8f555e879f1ed9468316eb2e0cb2af3e54a1f6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Windows\Syswow64\f530fbf4C:\Windows\Syswow64\f530fbf41⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\f530fbf4
- Size 2.5MB
- SHA256 4d831d039094b5e0973166ae5e2469a5b267403394d8f91e23ae419fdc1edad3
- MD5 713b67a538699983c024103297f146f6
- SHA1 c24d42a323732562f30f48f13ba07ec70bb5c5fa
- SHA512 f7cfdfd833e800f284c089c9e18eaaf28323828e56b29f6f81825eded1fcc95ba2f9553d4c1dd16b399565ee0cf6d8c1752e25409aa28c994be7a38da5abdd54
- SSDEEP 49152:OHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:OnKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T1F4C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH