Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 23:25
Behavioral task
behavioral1
Sample
82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe
- Size 766KB
- Sample260920-3el4vs1epc
- SHA256 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5
- MD5 85784a54757a7805c445e2adb82379d7
- SHA1 e5d8e32b479a8ca1ac0db36d1c7124e7d0f9db6a
- SHA512 704301dfffd0cdff621a6865f982c5b4a4543c3f6149be4c4b90c472c7b576258440c44eb625ec7780048f31a53deaa351adc6c63b331f809542a44a58e227f8
- SSDEEP 12288:wSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:rvO2xJKRw2kOkx2LFRvcUV
- TLSH T139F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4488 c0ed7f42 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe Destination IP 4 223.5.5.5 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe Destination IP 28 114.114.114.114 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe Destination IP 29 223.5.5.5 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c0ed7f42 File created C:\Windows\SysWOW64\c0ed7f42 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c0ed7f42 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c0ed7f42 -
resource yara_rule behavioral2/memory/276-0-0x0000000000B80000-0x0000000000C0C000-memory.dmp upx behavioral2/files/0x000600000001b867-2.dat upx behavioral2/memory/4488-3-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral2/memory/276-16-0x0000000000B80000-0x0000000000C0C000-memory.dmp upx behavioral2/memory/4488-17-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral2/memory/4488-34-0x0000000000870000-0x00000000008FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4cd610 c0ed7f42 File opened for modification C:\Windows\4b9a8 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0ed7f42 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c0ed7f42 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c0ed7f42 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c0ed7f42 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c0ed7f42 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c0ed7f42 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c0ed7f42 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c0ed7f42 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c0ed7f42 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c0ed7f42 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4488 c0ed7f42 4488 c0ed7f42 4488 c0ed7f42 4488 c0ed7f42 4488 c0ed7f42 4488 c0ed7f42 4488 c0ed7f42 4488 c0ed7f42 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe Token: SeTcbPrivilege 276 82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe Token: SeDebugPrivilege 4488 c0ed7f42 Token: SeTcbPrivilege 4488 c0ed7f42
Processes
-
C:\Users\Admin\AppData\Local\Temp\82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe"C:\Users\Admin\AppData\Local\Temp\82a94afe95357b55335cbb8c1572f3caa3d8e167e9351c1696c91e5893b3cfb5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:276
-
C:\Windows\Syswow64\c0ed7f42C:\Windows\Syswow64\c0ed7f421⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c0ed7f42
- Size 766KB
- SHA256 22a4e0f5d6264daafa7359a990e01ef01798742f344fb8d37e2fe7a2f762f4e6
- MD5 e9b6c66062e2dc82e967666efbe83f27
- SHA1 e90c4647aecb10079240441eb198e84b71f5c964
- SHA512 c024cfb415eb204af7ad527e85ba048fbc3ceb992727580c76b3f0767235bba38a6e1fd9f065a2f056764a0ad6eeb6eb85bddd0ee73d05db58b19e115ea0915e
- SSDEEP 12288:5SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:AvO2xJKRw2kOkx2LFRvcUV
- TLSH T156F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH