Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 00:17
Behavioral task
behavioral1
Sample
718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe
- Size 560KB
- Sample260831-ak55pseb29
- SHA256 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2
- MD5 5ffd2ad232945bd28400deb42c84afa1
- SHA1 dabf09e66d45b559a4c6dd8e1558cc8fa03a5a6c
- SHA512 17ff473a41830e55d5a94b42f2d91182832f158359c63002399c339e4083b273e59e84f49568184a1d9835610729a4d8a813a853780d441b42fcd1a5c2f33d6b
- SSDEEP 6144:q4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:qrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T182C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 772 a0c1ab70 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 383 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 47 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 122 114.114.114.114 772 a0c1ab70 Destination IP 183 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 444 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 4 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 48 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 181 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 3 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 120 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 121 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 284 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 351 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 443 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 138 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 281 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 352 223.5.5.5 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Destination IP 382 114.114.114.114 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a0c1ab70 File created C:\Windows\SysWOW64\a0c1ab70 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a0c1ab70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a0c1ab70 -
resource yara_rule behavioral1/memory/1636-0-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral1/files/0x001d000000016810-2.dat upx behavioral1/memory/772-3-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral1/memory/1636-16-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral1/memory/772-17-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral1/memory/772-34-0x0000000000080000-0x000000000010C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\d3788 a0c1ab70 File opened for modification C:\Windows\1c0248 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0c1ab70 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a0c1ab70 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a0c1ab70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a0c1ab70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a0c1ab70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a0c1ab70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a0c1ab70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a0c1ab70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a0c1ab70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a0c1ab70 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 772 a0c1ab70 772 a0c1ab70 772 a0c1ab70 772 a0c1ab70 772 a0c1ab70 772 a0c1ab70 772 a0c1ab70 772 a0c1ab70 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Token: SeTcbPrivilege 1636 718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe Token: SeDebugPrivilege 772 a0c1ab70 Token: SeTcbPrivilege 772 a0c1ab70
Processes
-
C:\Users\Admin\AppData\Local\Temp\718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe"C:\Users\Admin\AppData\Local\Temp\718db9b260ec81b8a075d6760cf7dadfb722c735f2976e6544a46dff163e9ea2.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
C:\Windows\Syswow64\a0c1ab70C:\Windows\Syswow64\a0c1ab701⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a0c1ab70
- Size 560KB
- SHA256 64fa20c5dd8df279bc73d070886e572e724023f9719f8ebefaa1a65dbf1e5f87
- MD5 8f1219d5c87df8790c197462714e5a55
- SHA1 c326c3f8806341f19a692b8bbda22b31ce007b4a
- SHA512 0601af1de11d192b042994065c109c78382ec48f083801f8a60549c5fb93d24b9e7c118c1df25b070dbea6cb4cc5dc1ad93a48db6cdeab4f6cec46cae3e3093a
- SSDEEP 6144:h4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:hrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T10FC48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH