Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 04:08
Behavioral task
behavioral1
Sample
620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe
- Size 832KB
- Sample260831-eqnvtsvbld
- SHA256 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67
- MD5 136129da8660b54915526ccd8d4bc96e
- SHA1 d9ba87a10017f4a3e8d773cb1de96570b289f89e
- SHA512 b5794254b04075de6cdf9f2354d5117a513ea31b45f3cf85e23161d3fd3d4d2ed6ddda6e049c1e8415bce0256edfcd571ec422f103cbb6e5830e2e14b39a06e3
- SSDEEP 12288:iqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:ijHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T191059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3724 34fa60c0 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 285 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 51 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 127 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 191 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 3 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 441 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 4 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 123 114.114.114.114 3724 34fa60c0 Destination IP 124 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 135 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 193 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 380 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 440 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 50 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 286 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 348 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 349 223.5.5.5 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Destination IP 379 114.114.114.114 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 34fa60c0 File created C:\Windows\SysWOW64\34fa60c0 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 34fa60c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 34fa60c0 -
resource yara_rule behavioral1/memory/436-0-0x0000000000610000-0x0000000000699000-memory.dmp upx behavioral1/files/0x000a000000024325-2.dat upx behavioral1/memory/3724-4-0x0000000000370000-0x00000000003F9000-memory.dmp upx behavioral1/memory/436-18-0x0000000000610000-0x0000000000699000-memory.dmp upx behavioral1/memory/3724-20-0x0000000000370000-0x00000000003F9000-memory.dmp upx behavioral1/memory/3724-26-0x0000000000370000-0x00000000003F9000-memory.dmp upx behavioral1/memory/436-39-0x0000000000610000-0x0000000000699000-memory.dmp upx behavioral1/memory/3724-40-0x0000000000370000-0x00000000003F9000-memory.dmp upx behavioral1/memory/3724-46-0x0000000000370000-0x00000000003F9000-memory.dmp upx behavioral1/memory/436-50-0x0000000000610000-0x0000000000699000-memory.dmp upx behavioral1/memory/436-51-0x0000000000610000-0x0000000000699000-memory.dmp upx behavioral1/memory/436-52-0x0000000000610000-0x0000000000699000-memory.dmp upx behavioral1/memory/436-57-0x0000000000610000-0x0000000000699000-memory.dmp upx behavioral1/memory/436-61-0x0000000000610000-0x0000000000699000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3fc198 34fa60c0 File opened for modification C:\Windows\776e8 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34fa60c0 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 34fa60c0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 34fa60c0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 34fa60c0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 34fa60c0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 34fa60c0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 34fa60c0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 34fa60c0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 34fa60c0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 34fa60c0 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 3724 34fa60c0 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Token: SeTcbPrivilege 436 620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe Token: SeDebugPrivilege 3724 34fa60c0 Token: SeTcbPrivilege 3724 34fa60c0
Processes
-
C:\Users\Admin\AppData\Local\Temp\620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe"C:\Users\Admin\AppData\Local\Temp\620cdd1d32d3323599fc34fcbafe66c8a4463dcdcbb31822ef0a31f880efec67.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436
-
C:\Windows\Syswow64\34fa60c0C:\Windows\Syswow64\34fa60c01⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\3fc198
- Size 650B
- SHA256 e24e8023b8ef769a6124403ae4646b7f10de7554d70f60e3b062ce45a3e9bead
- MD5 8b3b2d9330e7f4a89bcb4ab9d89e21ad
- SHA1 824224f0fed7ddba2809c0a6163d4c15ea2458cd
- SHA512 f3bdaf8a6d2b102554ed0f32752d4323d910a4ba433abbb5bf5171ac2dc01d7a1aa0bb2c3da7882cd155211e2628b5f08bd2486d1b72a92f53c29b1a105f951f
- TLSH T1B8F0F46A5E3910C7153957577318DACC56449E6420857910BB06BCA00456A26CC43C44
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\34fa60c0
- Size 832KB
- SHA256 cbed956638ab04201059bafc0a942ac93b354e9406a11c740386a303715a8e48
- MD5 135b52c634981c83b13125c525c3e57d
- SHA1 f5e391a1c8ed53e3c108e578b32724fa1e280b58
- SHA512 652a58e77abc28fcf6f4211bd4b77bf42b48ebbcd3cef1d7000c1c07677d57f1f5e35c1456f3bf0fe3ed5ffc3bc043222a7daa84ced997cdc8d6adf164f05ae0
- SSDEEP 12288:lqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:ljHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T1E7059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH