Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 03:23
Behavioral task
behavioral1
Sample
420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe
- Size 2.6MB
- Sample260831-dxt5raee36
- SHA256 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884
- MD5 a50fbb2ef7c1029462bde3c4ca971a7d
- SHA1 351f5fc31821a7a2b312fc4d397b92729d2588c5
- SHA512 b323b06088e212aae5d047269d9cfb48587e3b721ea6c075ecbc41c77e55dbfcc2ff9a817cefbc89272f7de0a7b96374f7b4f2030e627a2da9c122dce22057b4
- SSDEEP 49152:rTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:rKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T1D1C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 412 fceaf5f8 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 118 114.114.114.114 412 fceaf5f8 Destination IP 187 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 348 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 281 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 380 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 440 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 4 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 123 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 189 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 282 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 379 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 441 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 3 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 48 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 49 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 122 114.114.114.114 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 128 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Destination IP 349 223.5.5.5 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fceaf5f8 File created C:\Windows\SysWOW64\fceaf5f8 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fceaf5f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fceaf5f8 -
resource yara_rule behavioral1/memory/3048-0-0x00000000009C0000-0x0000000000A49000-memory.dmp upx behavioral1/files/0x000c00000002428e-2.dat upx behavioral1/memory/412-3-0x0000000000B10000-0x0000000000B99000-memory.dmp upx behavioral1/memory/3048-16-0x00000000009C0000-0x0000000000A49000-memory.dmp upx behavioral1/memory/412-18-0x0000000000B10000-0x0000000000B99000-memory.dmp upx behavioral1/memory/412-19-0x0000000000B10000-0x0000000000B99000-memory.dmp upx behavioral1/memory/3048-38-0x00000000009C0000-0x0000000000A49000-memory.dmp upx behavioral1/memory/412-39-0x0000000000B10000-0x0000000000B99000-memory.dmp upx behavioral1/memory/3048-42-0x00000000009C0000-0x0000000000A49000-memory.dmp upx behavioral1/memory/412-43-0x0000000000B10000-0x0000000000B99000-memory.dmp upx behavioral1/memory/412-45-0x0000000000B10000-0x0000000000B99000-memory.dmp upx behavioral1/memory/3048-49-0x00000000009C0000-0x0000000000A49000-memory.dmp upx behavioral1/memory/3048-51-0x00000000009C0000-0x0000000000A49000-memory.dmp upx behavioral1/memory/3048-56-0x00000000009C0000-0x0000000000A49000-memory.dmp upx behavioral1/memory/3048-59-0x00000000009C0000-0x0000000000A49000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\70db8 fceaf5f8 File opened for modification C:\Windows\342ed0 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fceaf5f8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fceaf5f8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fceaf5f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fceaf5f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fceaf5f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fceaf5f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fceaf5f8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fceaf5f8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fceaf5f8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fceaf5f8 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 412 fceaf5f8 412 fceaf5f8 412 fceaf5f8 412 fceaf5f8 412 fceaf5f8 412 fceaf5f8 412 fceaf5f8 412 fceaf5f8 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Token: SeTcbPrivilege 3048 420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe Token: SeDebugPrivilege 412 fceaf5f8 Token: SeTcbPrivilege 412 fceaf5f8
Processes
-
C:\Users\Admin\AppData\Local\Temp\420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe"C:\Users\Admin\AppData\Local\Temp\420f8934daa481ee8eee1de6a84d04fb5b22d2c0d850abff2aca2222c1b8a884.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
C:\Windows\Syswow64\fceaf5f8C:\Windows\Syswow64\fceaf5f81⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fceaf5f8
- Size 2.6MB
- SHA256 7735e32ea35a88efaf8f2c64701ab236db96618e8ae652f4d80a095e947d8124
- MD5 d5c6fd5bff6b0dcaf7344399cbdc5f73
- SHA1 ec51a4bd0e6fef77a339f581fd12c8a5da008c4e
- SHA512 6ec7af230b4e44dc8b60d4af6818c3e3fd86314806040189d97c66e728da19dbf78b09dbf2b3b939b95ab681316a4715d2dfcee80e747f2cfc8f0edfa4c6dc23
- SSDEEP 49152:ITGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:IKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T1A6C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH