Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 12:55
Behavioral task
behavioral1
Sample
7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe
- Size 576KB
- Sample260831-p5wt4ascrf
- SHA256 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18
- MD5 2e146b072059e96173869feb9a116b2b
- SHA1 19beab71bec1307d54871b191b421bce2e73cc3b
- SHA512 bf64022ea16677e2c36e69c6dd85b51f89c42bd69bb2774d1262da2b7474ff6547e23caa85ca2409beb6f1324196ca7442db4051182e53ee2f7f952d76db8340
- SSDEEP 12288:rqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:rjHPOSOkx2LFscUQPK
- TLSH T1EEC47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1932 5c1ac36a - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 166 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 167 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 237 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 1 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 96 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 324 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 377 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 95 114.114.114.114 1932 5c1ac36a Destination IP 104 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 294 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 323 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 3 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 40 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 102 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 236 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 293 114.114.114.114 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 378 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Destination IP 41 223.5.5.5 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5c1ac36a File created C:\Windows\SysWOW64\5c1ac36a 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5c1ac36a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5c1ac36a -
resource yara_rule behavioral2/memory/4884-0-0x0000000000E00000-0x0000000000E89000-memory.dmp upx behavioral2/files/0x000800000001b871-2.dat upx behavioral2/memory/1932-3-0x0000000000990000-0x0000000000A19000-memory.dmp upx behavioral2/memory/4884-16-0x0000000000E00000-0x0000000000E89000-memory.dmp upx behavioral2/memory/1932-18-0x0000000000990000-0x0000000000A19000-memory.dmp upx behavioral2/memory/1932-19-0x0000000000990000-0x0000000000A19000-memory.dmp upx behavioral2/memory/4884-42-0x0000000000E00000-0x0000000000E89000-memory.dmp upx behavioral2/memory/1932-43-0x0000000000990000-0x0000000000A19000-memory.dmp upx behavioral2/memory/1932-47-0x0000000000990000-0x0000000000A19000-memory.dmp upx behavioral2/memory/4884-48-0x0000000000E00000-0x0000000000E89000-memory.dmp upx behavioral2/memory/4884-54-0x0000000000E00000-0x0000000000E89000-memory.dmp upx behavioral2/memory/4884-66-0x0000000000E00000-0x0000000000E89000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\211398 5c1ac36a File opened for modification C:\Windows\539da8 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c1ac36a - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5c1ac36a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5c1ac36a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5c1ac36a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5c1ac36a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5c1ac36a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5c1ac36a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5c1ac36a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5c1ac36a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5c1ac36a - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1932 5c1ac36a 1932 5c1ac36a 1932 5c1ac36a 1932 5c1ac36a 1932 5c1ac36a 1932 5c1ac36a 1932 5c1ac36a 1932 5c1ac36a 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Token: SeTcbPrivilege 4884 7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe Token: SeDebugPrivilege 1932 5c1ac36a Token: SeTcbPrivilege 1932 5c1ac36a
Processes
-
C:\Users\Admin\AppData\Local\Temp\7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe"C:\Users\Admin\AppData\Local\Temp\7487b528ffc53a3e66736f3151648fbb51723ab0ac7081436a57406396113e18.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
C:\Windows\Syswow64\5c1ac36aC:\Windows\Syswow64\5c1ac36a1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5c1ac36a
- Size 576KB
- SHA256 e97f9964849fb598fb5bcc5974ff228af4b23d16d28100c28dbdfeac2bc0e2db
- MD5 546bcd00438bb7a24dde3d07af2b5b0d
- SHA1 bac4b904ef2ac9038a6877f839a4e068e9560723
- SHA512 a572dd88036056eb2f134af9b43a41c0071d2b4d4d6f2b2da7cfb1f46f12ac96c99b56a0de9705b30ae91e7bce0363399a33b4ed4316b691618e54de5c4cf3a8
- SSDEEP 12288:JqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:JjHPOSOkx2LFscUQPK
- TLSH T124C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH