Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 11:31
Behavioral task
behavioral1
Sample
d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe
- Size 2.5MB
- Sample260907-nmtfkswane
- SHA256 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca
- MD5 0d2f4f169b550efcd85a0829e9049e94
- SHA1 e84f5a4016df1e2a154d361139474d4fa3b6e864
- SHA512 eb75a7dc54a27811cb99520f7de5aea863656ac8108bd83b5ba1186244b8eb3c7455485b9be06ccd3a5b147094339920c202d2501111e7aa5fb9dfa53ea0f328
- SSDEEP 49152:9HHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:9nKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T166C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3552 6ca934a8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 6 223.5.5.5 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe Destination IP 18 114.114.114.114 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe Destination IP 19 223.5.5.5 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe Destination IP 4 114.114.114.114 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6ca934a8 File created C:\Windows\SysWOW64\6ca934a8 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 6ca934a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6ca934a8 -
resource yara_rule behavioral2/memory/4816-0-0x00000000004C0000-0x000000000054C000-memory.dmp upx behavioral2/files/0x000f000000016cdb-2.dat upx behavioral2/memory/3552-3-0x0000000000700000-0x000000000078C000-memory.dmp upx behavioral2/memory/4816-23-0x00000000004C0000-0x000000000054C000-memory.dmp upx behavioral2/memory/3552-24-0x0000000000700000-0x000000000078C000-memory.dmp upx behavioral2/memory/3552-43-0x0000000000700000-0x000000000078C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3ccfc0 6ca934a8 File opened for modification C:\Windows\5273a0 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ca934a8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 6ca934a8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 6ca934a8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 6ca934a8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 6ca934a8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 6ca934a8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 6ca934a8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 6ca934a8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 6ca934a8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 6ca934a8 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 3552 6ca934a8 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe Token: SeTcbPrivilege 4816 d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe Token: SeDebugPrivilege 3552 6ca934a8 Token: SeTcbPrivilege 3552 6ca934a8
Processes
-
C:\Users\Admin\AppData\Local\Temp\d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe"C:\Users\Admin\AppData\Local\Temp\d313fc6782e5f3480af776d17879f0435fb4d6952adcf4ee6652f30ccc5c19ca.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
C:\Windows\Syswow64\6ca934a8C:\Windows\Syswow64\6ca934a81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\3ccfc0
- Size 916B
- SHA256 4abaf04d00b9ad7183849ba7af88957666782554ee0a0f59134bdb093795170c
- MD5 5792900706ffc7be030d1754b5ddc789
- SHA1 0908c3b41ab40c427d5f7e93fbb7ee6e9f4d21fb
- SHA512 a6e5f215edf40848a51bbe925e4806a560ff76c9512491ff08edb67cc5c49c65c46ff84bd803421ed27a61fbe477a4ea46ca8f51cec50f3172b0c80f93de04b7
- TLSH T1EB115CB59459C3E28CAA436037F3B9C87F34B4ABC4EE44972883A04828633DCE1A1445
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\6ca934a8
- Size 2.5MB
- SHA256 ca987d821f1cc5db08df8c89bcdc3470bc996cdbf16455d35456aebc1eee25f8
- MD5 7b8ddc71464c764394c47d50ebdc702f
- SHA1 9e535a9073d4a9293505e13486dcb6a044a1aae4
- SHA512 59c81de88cd34efcea013125e126509bf9176ec3249c923af1b88ae1f26c9552bb2672881231ae7b2584cfa2e0db1d98524278dba1add769f217e0bfcca0d5c8
- SSDEEP 49152:aHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:anKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T143C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH