Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 15:01
Behavioral task
behavioral1
Sample
8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe
- Size 560KB
- Sample260919-sd5jpsgf47
- SHA256 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9
- MD5 e4c098dc18e63a30a23126e03a6dd87b
- SHA1 bf69e2ba0416a463f505b837c7e3ad9ea567bb6b
- SHA512 c2f705ecba55e605d992dde33fef6f0d888b9c30eacc4ab688399cfe8c581e805e36033f2647c9ba3d184fecc35758f0d45b65c7d6af9d0c8004e5110649b426
- SSDEEP 6144:V4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:VrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T198C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2800 e4adb3a4 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 45 114.114.114.114 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe Destination IP 46 223.5.5.5 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe Destination IP 3 114.114.114.114 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe Destination IP 6 223.5.5.5 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e4adb3a4 File created C:\Windows\SysWOW64\e4adb3a4 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e4adb3a4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e4adb3a4 -
resource yara_rule behavioral1/memory/5032-0-0x0000000000190000-0x000000000021C000-memory.dmp upx behavioral1/files/0x001400000002444d-2.dat upx behavioral1/memory/2800-4-0x00000000007F0000-0x000000000087C000-memory.dmp upx behavioral1/memory/5032-12-0x0000000000190000-0x000000000021C000-memory.dmp upx behavioral1/memory/2800-13-0x00000000007F0000-0x000000000087C000-memory.dmp upx behavioral1/memory/2800-27-0x00000000007F0000-0x000000000087C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2fefe0 e4adb3a4 File opened for modification C:\Windows\562650 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4adb3a4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e4adb3a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e4adb3a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e4adb3a4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e4adb3a4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e4adb3a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e4adb3a4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e4adb3a4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e4adb3a4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e4adb3a4 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 2800 e4adb3a4 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe Token: SeTcbPrivilege 5032 8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe Token: SeDebugPrivilege 2800 e4adb3a4 Token: SeTcbPrivilege 2800 e4adb3a4
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe"C:\Users\Admin\AppData\Local\Temp\8ad1288ef0c9103938c39023833b046e619ba7b403b2536efa8b5f6b1800abb9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
C:\Windows\Syswow64\e4adb3a4C:\Windows\Syswow64\e4adb3a41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e4adb3a4
- Size 560KB
- SHA256 12bbff221fd2b63680f728b1a52c714b45481bddcb2903b45195265fb816cb8b
- MD5 0dfe50ca58752d39015f009570517f3f
- SHA1 52f214590ba0c60c6f2d2ea8942d1c50086dae8c
- SHA512 2366d470e3ab45f12fcadefb0bea1f87d44c503371e714532d26a479111a9c97fe8f5d6942cd7dbaac92674b1c04721519b334da711ea92a5989cbbe81656525
- SSDEEP 6144:74ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:7rNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T15EC48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH