Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 05:59
Behavioral task
behavioral1
Sample
30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe
- Size 2.6MB
- Sample260909-gp615asth1
- SHA256 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e
- MD5 a92c6aed1fc4f1ea56a06a67229daaca
- SHA1 addca262ad84362d8a526b82d68a24b1cb680b22
- SHA512 f7e824245fbbc6b8bda2e2add4254763bb31fb1bb9992bea71c9e6f22ea2b8c7310aefc0cac3e0a91675176098a2bc51ce05a26771d68b5e5f582003a684b684
- SSDEEP 49152:wTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:wKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T1DEC59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4004 3a4396b6 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 14 223.5.5.5 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe Destination IP 1 114.114.114.114 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe Destination IP 4 223.5.5.5 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe Destination IP 13 114.114.114.114 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3a4396b6 File created C:\Windows\SysWOW64\3a4396b6 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 3a4396b6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3a4396b6 -
resource yara_rule behavioral2/memory/4124-0-0x0000000000270000-0x00000000002F9000-memory.dmp upx behavioral2/files/0x000e00000001c48a-2.dat upx behavioral2/memory/4004-3-0x00000000006C0000-0x0000000000749000-memory.dmp upx behavioral2/memory/4124-15-0x0000000000270000-0x00000000002F9000-memory.dmp upx behavioral2/memory/4004-17-0x00000000006C0000-0x0000000000749000-memory.dmp upx behavioral2/memory/4124-37-0x0000000000270000-0x00000000002F9000-memory.dmp upx behavioral2/memory/4004-38-0x00000000006C0000-0x0000000000749000-memory.dmp upx behavioral2/memory/4124-48-0x0000000000270000-0x00000000002F9000-memory.dmp upx behavioral2/memory/4124-58-0x0000000000270000-0x00000000002F9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\448cc8 3a4396b6 File opened for modification C:\Windows\469ab8 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a4396b6 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3a4396b6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3a4396b6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3a4396b6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3a4396b6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3a4396b6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3a4396b6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3a4396b6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3a4396b6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3a4396b6 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4004 3a4396b6 4004 3a4396b6 4004 3a4396b6 4004 3a4396b6 4004 3a4396b6 4004 3a4396b6 4004 3a4396b6 4004 3a4396b6 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe Token: SeTcbPrivilege 4124 30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe Token: SeDebugPrivilege 4004 3a4396b6 Token: SeTcbPrivilege 4004 3a4396b6
Processes
-
C:\Users\Admin\AppData\Local\Temp\30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe"C:\Users\Admin\AppData\Local\Temp\30d9cc083146333e370f23c9cf67deba417e101b322856e731b01939988db95e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
C:\Windows\Syswow64\3a4396b6C:\Windows\Syswow64\3a4396b61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3a4396b6
- Size 2.6MB
- SHA256 423eca0ada2531ccf91d766b9019eb5b7f78adaae1f87f9da5efd1f2b0a1a576
- MD5 7b8298317c3bb9af6c48b63ec31a1e9d
- SHA1 3650724c3dd7b4e6fa3556719fd3cf2f323a9917
- SHA512 ebfeb6da1d90e4aa5113b3bd9be23c7245221764b22da2034d37a1d47d7447e715bad7fdb9c6c914a4ceba6a9b543b47ad46b812e315176d35fb5ed80b5b8793
- SSDEEP 49152:QTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:QKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T17CC59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH