Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 00:23
Behavioral task
behavioral1
Sample
35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe
- Size 761KB
- Sample260824-apw3labq71
- SHA256 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7
- MD5 e6e50af6277f2647455a71e2a95a41d2
- SHA1 3f90662bc1c6f97a5be58afae68b7c15506f7305
- SHA512 bbc3dfd9355ee24744149bd518972ba5535d3ba550cb041541b6e398806a062b8bc0aaa153f32729332df8c2a19970880c02c5247846f124045c6852852687c2
- SSDEEP 12288:qSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:xvO2xJKRw2kOkxSkW298B
- TLSH T187F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4032 9b7db9d3 - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 82 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 121 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 80 114.114.114.114 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 138 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 229 114.114.114.114 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 316 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 1 114.114.114.114 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 41 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 137 114.114.114.114 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 230 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 285 114.114.114.114 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 286 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 315 114.114.114.114 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 2 223.5.5.5 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 40 114.114.114.114 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Destination IP 112 114.114.114.114 4032 9b7db9d3 - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9b7db9d3 File created C:\Windows\SysWOW64\9b7db9d3 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9b7db9d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9b7db9d3 -
resource yara_rule behavioral2/memory/5312-0-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx behavioral2/memory/4032-3-0x0000000000530000-0x00000000005BC000-memory.dmp upx behavioral2/files/0x001100000001b664-4.dat upx behavioral2/memory/5312-18-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx behavioral2/memory/4032-19-0x0000000000530000-0x00000000005BC000-memory.dmp upx behavioral2/memory/4032-40-0x0000000000530000-0x00000000005BC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\450780 9b7db9d3 File opened for modification C:\Windows\5af180 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b7db9d3 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9b7db9d3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9b7db9d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9b7db9d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9b7db9d3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9b7db9d3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9b7db9d3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9b7db9d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9b7db9d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9b7db9d3 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4032 9b7db9d3 4032 9b7db9d3 4032 9b7db9d3 4032 9b7db9d3 4032 9b7db9d3 4032 9b7db9d3 4032 9b7db9d3 4032 9b7db9d3 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Token: SeTcbPrivilege 5312 35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe Token: SeDebugPrivilege 4032 9b7db9d3 Token: SeTcbPrivilege 4032 9b7db9d3
Processes
-
C:\Users\Admin\AppData\Local\Temp\35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe"C:\Users\Admin\AppData\Local\Temp\35c6c9ce46b708a923e95aba1a982f8a9291018e881919a52ba731fb1c6e92d7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5312
-
C:\Windows\Syswow64\9b7db9d3C:\Windows\Syswow64\9b7db9d31⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9b7db9d3
- Size 761KB
- SHA256 289026805db757f1bce07e4d18a9645f85cdfdc1688025b6caeeea0fb602fe6d
- MD5 c89558ab88a3c7e2f8c3d3f5000709b5
- SHA1 a42411c41530575a16850d25fe3545e77920893d
- SHA512 1a186eb2260377b3eed53244b04dc2c9defb340e1378dd343af723742b445088472feeb31f6780fdf3492a2e8224bf3b742169461edfafd8967f3a9057df415f
- SSDEEP 12288:QSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:LvO2xJKRw2kOkxSkW298B
- TLSH T14BF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH