Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe
- Size 2.4MB
- Sample260831-e4ybesvcmb
- SHA256 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c
- MD5 283a8e79a330c56aae6146f27d8e395c
- SHA1 cd4de5c3bedd3881c15c25e1065c8c182c527134
- SHA512 6ae6d4b90c8b697cda72f7aa6f1a364ffc99abef847f53171cb05a681d99616b847c1fd6f6b1114f1b1e3803edc55641052be1d3fadd70d0f01f242c6f3f774f
- SSDEEP 49152:cHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:cnKdVkOhCXHHFZMjHfUKkVWsi
- TLSH T131B58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 6036 fc0c3238 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 41 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 166 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 293 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 322 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 323 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 2 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 95 114.114.114.114 6036 fc0c3238 Destination IP 96 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 165 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 236 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 377 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 4 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 40 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 102 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 103 223.5.5.5 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 235 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 292 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Destination IP 376 114.114.114.114 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fc0c3238 File created C:\Windows\SysWOW64\fc0c3238 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fc0c3238 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fc0c3238 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2cb7e8 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe File opened for modification C:\Windows\6756a8 fc0c3238 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc0c3238 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fc0c3238 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fc0c3238 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fc0c3238 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fc0c3238 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fc0c3238 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fc0c3238 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fc0c3238 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fc0c3238 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fc0c3238 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 6036 fc0c3238 6036 fc0c3238 6036 fc0c3238 6036 fc0c3238 6036 fc0c3238 6036 fc0c3238 6036 fc0c3238 6036 fc0c3238 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Token: SeTcbPrivilege 2612 d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe Token: SeDebugPrivilege 6036 fc0c3238 Token: SeTcbPrivilege 6036 fc0c3238
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe"C:\Users\Admin\AppData\Local\Temp\d0e882735cbd615ecc8798943c5f6f0de3d75b59ff76a72dcecf187e211f101c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
C:\Windows\Syswow64\fc0c3238C:\Windows\Syswow64\fc0c32381⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fc0c3238
- Size 2.4MB
- SHA256 4ad82c0142b2aae639f16f0e452e02b38d93796a127547688678b444c5fb2241
- MD5 59f1dde0ee7f0bc3cccc336fdb122e5c
- SHA1 5649998c8a91ad3decdc0411a3e5a7e11ffb0cf1
- SHA512 79cf3ef7257140431fc0c4898b5289f4ed0f66f2dd5285ea44cf79b640cc24560b8b49482cd76e07675333ef894e065e3a62d58315a0b34086c4c445280abc19
- SSDEEP 49152:8HHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:8nKdVkOhCXHHFZMjHfUKkVWsi
- TLSH T1A7B58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH