Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 00:26
Behavioral task
behavioral1
Sample
295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe
- Size 560KB
- Sample260831-aramdaserf
- SHA256 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449
- MD5 3112c303d06bc869061d123d427dd8e6
- SHA1 5a81451ab683d7c54c81ccaf091438169cf04534
- SHA512 8ce83a6908ffabfce5d1e27f4f7ce725bba7a7741f562cb4f3c9cc22f47ecdf67c993e4f3e143885138bad4185ae37b991cda7da3aa50cab26155c1096a7f802
- SSDEEP 6144:T6UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:TO7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T19AC46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4624 fb501d78 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe Destination IP 6 223.5.5.5 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe Destination IP 23 114.114.114.114 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe Destination IP 24 223.5.5.5 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\fb501d78 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fb501d78 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fb501d78 -
resource yara_rule behavioral1/memory/4128-0-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx behavioral1/files/0x001a000000024450-3.dat upx behavioral1/memory/4624-4-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral1/memory/4128-10-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/4624-11-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral1/memory/4624-21-0x0000000000120000-0x00000000001AC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4f2a20 fb501d78 File opened for modification C:\Windows\46ac40 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb501d78 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fb501d78 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fb501d78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fb501d78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fb501d78 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fb501d78 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fb501d78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fb501d78 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fb501d78 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fb501d78 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4624 fb501d78 4624 fb501d78 4624 fb501d78 4624 fb501d78 4624 fb501d78 4624 fb501d78 4624 fb501d78 4624 fb501d78 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe Token: SeTcbPrivilege 4128 295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe Token: SeDebugPrivilege 4624 fb501d78 Token: SeTcbPrivilege 4624 fb501d78
Processes
-
C:\Users\Admin\AppData\Local\Temp\295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe"C:\Users\Admin\AppData\Local\Temp\295fb75974895abf075f9abd552b84463141e6ed34de4c407d27c806412cc449.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
C:\Windows\Syswow64\fb501d78C:\Windows\Syswow64\fb501d781⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fb501d78
- Size 560KB
- SHA256 e4411973e5ed82d9d93acebfbb94d590319fe1ac07c7c11870b2a909ea8143f0
- MD5 4beaad8e2a6536d7afd1e423394f339c
- SHA1 ebbadc15344e21eecaae2fc31519acf8c2117120
- SHA512 92b365e5e8e7db23ce55e69d002c34a0ebe825507fbad0894999f2ed8905e909e57c604f87437593ead94d83314dc8184f665c128fe0fa5a8405217e92bb77ad
- SSDEEP 6144:M6UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:MO7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T13CC46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH