Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 09:37
Behavioral task
behavioral1
Sample
1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe
- Size 830KB
- Sample260922-llnslashmf
- SHA256 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf
- MD5 a89f7be8c14bb28dd9d43f452ffe9b0c
- SHA1 a6d2b1e53d02702068377a5410eb23a123c52b14
- SHA512 c5f940fbc4681f781a11645a1a8d96eeb12914c1a4ea275e6bc229ecc2bef1929f625cd4ac23caa8f6c13b8998e9c3bdb319784f606844354fcebb62b3c7bcc6
- SSDEEP 12288:wSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:rvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T198055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4648 40d478ca - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 128 114.114.114.114 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Destination IP 129 223.5.5.5 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Destination IP 3 114.114.114.114 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Destination IP 5 223.5.5.5 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Destination IP 42 114.114.114.114 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Destination IP 43 223.5.5.5 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 40d478ca File created C:\Windows\SysWOW64\40d478ca 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 40d478ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 40d478ca -
resource yara_rule behavioral1/memory/2968-0-0x0000000000D90000-0x0000000000E1C000-memory.dmp upx behavioral1/files/0x000c000000024316-2.dat upx behavioral1/memory/4648-4-0x00000000006D0000-0x000000000075C000-memory.dmp upx behavioral1/memory/2968-12-0x0000000000D90000-0x0000000000E1C000-memory.dmp upx behavioral1/memory/4648-13-0x00000000006D0000-0x000000000075C000-memory.dmp upx behavioral1/memory/4648-32-0x00000000006D0000-0x000000000075C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4f9350 40d478ca File opened for modification C:\Windows\32d030 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40d478ca - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 40d478ca Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 40d478ca Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 40d478ca Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 40d478ca Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 40d478ca Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 40d478ca Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 40d478ca Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 40d478ca Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 40d478ca - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 4648 40d478ca 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Token: SeTcbPrivilege 2968 1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe Token: SeDebugPrivilege 4648 40d478ca Token: SeTcbPrivilege 4648 40d478ca
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe"C:\Users\Admin\AppData\Local\Temp\1b5784bcd193ad2bd7515ad1c1aa3225a46d7b2cee397738bd1c695448deadcf.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
C:\Windows\Syswow64\40d478caC:\Windows\Syswow64\40d478ca1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\40d478ca
- Size 830KB
- SHA256 5cfc1af8a0858e4414342a059ddea32f6d7828caf2455fa83714e0758e570c23
- MD5 1b48812198877bf76c8f700ca0c51568
- SHA1 6fcc68a6fc1f9f051dbbd9b17401b2b23911cf7c
- SHA512 079a3dcae47160eb0d6db696f59686367c1e4dd7af580ce710e4ceb9339d37cce75a78ca09cf3cd61f7cf3a88e0222a25d0b2896b7b543dd63eef2bd2449d5c8
- SSDEEP 12288:6SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:hvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T146055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH