Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 02:20
Behavioral task
behavioral1
Sample
376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe
- Size 548KB
- Sample260831-csfacscm3z
- SHA256 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f
- MD5 3fb576c019f3acab997828b9b81941d9
- SHA1 09d793f86d3a0ecc9f13f5ce6b738fe3251dcb67
- SHA512 54eec9cda1c03cc7280eded8bd9be5f781eefe134141726707f984eaf0995ef029304c3782dbf152721a3949c8dbd5599574b752221294023b9460b3bedd0e37
- SSDEEP 6144:gl51orRJXlDixHkUXe35rBcEOkCybEaQRXr9HNdvOa:0qXUHkUXe39hOkx2LIa
- TLSH T110C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4868 1966a5c2 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 323 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 1 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 40 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 96 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 169 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 292 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 376 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 3 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 95 114.114.114.114 4868 1966a5c2 Destination IP 102 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 104 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 236 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 322 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 377 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 41 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 168 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 235 114.114.114.114 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Destination IP 293 223.5.5.5 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1966a5c2 File created C:\Windows\SysWOW64\1966a5c2 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1966a5c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1966a5c2 -
resource yara_rule behavioral2/memory/1128-0-0x0000000000B90000-0x0000000000C19000-memory.dmp upx behavioral2/files/0x000600000001b848-2.dat upx behavioral2/memory/4868-3-0x0000000000920000-0x00000000009A9000-memory.dmp upx behavioral2/memory/1128-16-0x0000000000B90000-0x0000000000C19000-memory.dmp upx behavioral2/memory/4868-18-0x0000000000920000-0x00000000009A9000-memory.dmp upx behavioral2/memory/4868-19-0x0000000000920000-0x00000000009A9000-memory.dmp upx behavioral2/memory/1128-42-0x0000000000B90000-0x0000000000C19000-memory.dmp upx behavioral2/memory/4868-43-0x0000000000920000-0x00000000009A9000-memory.dmp upx behavioral2/memory/4868-47-0x0000000000920000-0x00000000009A9000-memory.dmp upx behavioral2/memory/1128-48-0x0000000000B90000-0x0000000000C19000-memory.dmp upx behavioral2/memory/1128-53-0x0000000000B90000-0x0000000000C19000-memory.dmp upx behavioral2/memory/1128-54-0x0000000000B90000-0x0000000000C19000-memory.dmp upx behavioral2/memory/1128-59-0x0000000000B90000-0x0000000000C19000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\535788 1966a5c2 File opened for modification C:\Windows\134fd0 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1966a5c2 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1966a5c2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1966a5c2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1966a5c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1966a5c2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1966a5c2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1966a5c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1966a5c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1966a5c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1966a5c2 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4868 1966a5c2 4868 1966a5c2 4868 1966a5c2 4868 1966a5c2 4868 1966a5c2 4868 1966a5c2 4868 1966a5c2 4868 1966a5c2 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Token: SeTcbPrivilege 1128 376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe Token: SeDebugPrivilege 4868 1966a5c2 Token: SeTcbPrivilege 4868 1966a5c2
Processes
-
C:\Users\Admin\AppData\Local\Temp\376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe"C:\Users\Admin\AppData\Local\Temp\376335b2de1e58801585c9678269789c7bbd3d6ed9636080ea30ecbf0a27535f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
C:\Windows\Syswow64\1966a5c2C:\Windows\Syswow64\1966a5c21⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1966a5c2
- Size 548KB
- SHA256 9708238cef5ec06d686d28477948243c144a04200563d912113282bf3738ef74
- MD5 5059664ac45e9ec29f9240cb690eb838
- SHA1 162211c3e3f2dd2f75408bd1ecc3d6f24dfe90c4
- SHA512 7523c0f2dc486a11c7b9b631487bf002541dbdbbca1952ec5b1784090d7258ab40242eed6da231ac34154726b346000c9cab858455c8324b892d940a4ac05c95
- SSDEEP 6144:8l51orRJXlDixHkUXe35rBcEOkCybEaQRXr9HNdvOa:gqXUHkUXe39hOkx2LIa
- TLSH T161C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH