Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 02:00
Behavioral task
behavioral1
Sample
a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe
- Size 1.2MB
- Sample260905-ce81hsbd67
- SHA256 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e
- MD5 20574980b988cbaf3b0799b2c31a87c1
- SHA1 47df6a5769af4cf52b880182d86cbc02b45ef24b
- SHA512 b1618e569f03055c44746cd5a7e6f28bc50a581de1e015f07e540e93bcbd86082cb35bc5679be7fdd87a6330dd6df1c5e82d7d4c8e9778d6fa6cfe88d9efc30a
- SSDEEP 24576:TvO2xJKRw2kOkx2LFRvhuZ98Es8k3OH3C0rQ6+y:THHKe2WQXhuTtS0rQi
- TLSH T19E559E31E641C036D4A70176C6B94BBFA578BD22072555CBE3D43A6A2F722D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4928 8e2d58ef - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 32 114.114.114.114 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe Destination IP 33 223.5.5.5 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe Destination IP 3 114.114.114.114 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe Destination IP 4 223.5.5.5 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8e2d58ef File created C:\Windows\SysWOW64\8e2d58ef a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8e2d58ef File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8e2d58ef -
resource yara_rule behavioral1/memory/552-0-0x0000000000D30000-0x0000000000DBC000-memory.dmp upx behavioral1/files/0x00200000000243c4-2.dat upx behavioral1/memory/4928-4-0x0000000000AB0000-0x0000000000B3C000-memory.dmp upx behavioral1/memory/552-17-0x0000000000D30000-0x0000000000DBC000-memory.dmp upx behavioral1/memory/4928-18-0x0000000000AB0000-0x0000000000B3C000-memory.dmp upx behavioral1/memory/4928-39-0x0000000000AB0000-0x0000000000B3C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\545e80 8e2d58ef File opened for modification C:\Windows\97350 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e2d58ef - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8e2d58ef Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8e2d58ef Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8e2d58ef Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8e2d58ef Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8e2d58ef Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8e2d58ef Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8e2d58ef Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8e2d58ef Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8e2d58ef - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 8e2d58ef Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 8e2d58ef - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 4928 8e2d58ef 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe Token: SeTcbPrivilege 552 a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe Token: SeDebugPrivilege 4928 8e2d58ef Token: SeTcbPrivilege 4928 8e2d58ef
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe"C:\Users\Admin\AppData\Local\Temp\a8bba2b86399c8d2583f4c2e95922b4104303237c9121a60b6fada3080dbb63e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552
-
C:\Windows\Syswow64\8e2d58efC:\Windows\Syswow64\8e2d58ef1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\8e2d58ef
- Size 1.2MB
- SHA256 a74643dc8800f57ee397009ec08d95456cb30856b15a53fdb7797d8db14d6aab
- MD5 efc097dfa070cf85dee3074b4d40e643
- SHA1 433937ad3f9a5fd0264741da6dcdea9cbac61caa
- SHA512 13bdd72992cb107fd83862df46b3fb27fd13868dfdb716bd263382a9ac8fbcf43b9450bad5db89f2564b2084a00e743cb5ce6874ac1a9bc039214e14d567b50a
- SSDEEP 24576:4vO2xJKRw2kOkx2LFRvhuZ98Es8k3OH3C0rQ6+y:4HHKe2WQXhuTtS0rQi
- TLSH T1D3559E31E641C036D4A70176C6B94BBFA578BD22072555CBE3D43A6A2F722D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH