Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 02:47
Behavioral task
behavioral1
Sample
e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe
- Size 548KB
- Sample260831-daagtswwcs
- SHA256 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1
- MD5 72280af28527daff1fa36c60bc77ee12
- SHA1 ab3f1a1c3d786a06fe8b52c44775c83c3a6fe474
- SHA512 ac1839e1d1cf26a6b0648bc0f9cc2aa965985fc9c0d9929621b601e657bac3e76e93a4268b5dbc500bb02db0c206225f9c28d27a99848de4eff9697639c014d3
- SSDEEP 12288:+kbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:HbOgbEqy9RKejHPOwOkx2LF
- TLSH T1D0C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 828 be2d99af - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 377 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 40 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 95 114.114.114.114 828 be2d99af Destination IP 236 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 323 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 104 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 166 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 292 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 1 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 3 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 41 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 235 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 322 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 376 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 96 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 102 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 165 114.114.114.114 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Destination IP 293 223.5.5.5 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 be2d99af File created C:\Windows\SysWOW64\be2d99af e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 be2d99af File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 be2d99af -
resource yara_rule behavioral2/memory/5732-0-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral2/files/0x0008000000016cdf-2.dat upx behavioral2/memory/828-3-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral2/memory/5732-16-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral2/memory/828-18-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral2/memory/5732-41-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral2/memory/828-42-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral2/memory/5732-45-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral2/memory/828-46-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral2/memory/5732-52-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral2/memory/5732-53-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\e2cf8 be2d99af File opened for modification C:\Windows\622248 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be2d99af - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" be2d99af Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" be2d99af Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" be2d99af Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" be2d99af Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing be2d99af Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" be2d99af Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix be2d99af Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" be2d99af Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ be2d99af - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 828 be2d99af 828 be2d99af 828 be2d99af 828 be2d99af 828 be2d99af 828 be2d99af 828 be2d99af 828 be2d99af 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Token: SeTcbPrivilege 5732 e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe Token: SeDebugPrivilege 828 be2d99af Token: SeTcbPrivilege 828 be2d99af
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe"C:\Users\Admin\AppData\Local\Temp\e0bdb26dd9726709611e38b5fab8d07781ed505c23dae42721fe37e00e26b7b1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5732
-
C:\Windows\Syswow64\be2d99afC:\Windows\Syswow64\be2d99af1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\be2d99af
- Size 548KB
- SHA256 0aba82c4a8e1b215843239c6df28ceb8f034226b8c1811849af23e295c3589a1
- MD5 c381ad01b53a0bee0dc822d85c693f31
- SHA1 e4decece5393f900855810fdc35fd39c595eaf3e
- SHA512 e62a5dca514f3c12df698940cd901d455ae3a5a98951235e7f6ae50bae3c7a58e5651568602042aa4c5d21909bcb336a15f37f4cd9c51ad53a8c73cb340ac34e
- SSDEEP 12288:NkbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:ybOgbEqy9RKejHPOwOkx2LF
- TLSH T1EBC4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH