Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 14:34
Behavioral task
behavioral1
Sample
f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe
- Size 766KB
- Sample260924-rxft1sfc32
- SHA256 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac
- MD5 9c1617f23138fcdfa7e64217df99ed97
- SHA1 33559ff465c19387a7aad192d20d98a5597c3a1a
- SHA512 028dffdd876bd0e3eb0e2b11b9e575bc3316f01e7c70a9ce05129f9e9c29be4fbe7947e745dffbb90cac8e3a812b4acf86494648fb2904ad9c209795081e7c68
- SSDEEP 12288:ASvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:bvO2xJKRw2kOkx2LFRvcUV
- TLSH T1CDF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1172 911f9fb4 - Unexpected DNS network traffic destination 27 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 64 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 65 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 300 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 486 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 643 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 703 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 125 114.114.114.114 1172 911f9fb4 Destination IP 130 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 196 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 239 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 299 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 487 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 551 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 611 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 5 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 343 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 390 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 391 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 455 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 552 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 612 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 642 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 339 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 3 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 197 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 238 114.114.114.114 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Destination IP 456 223.5.5.5 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 911f9fb4 File created C:\Windows\SysWOW64\911f9fb4 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 911f9fb4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 911f9fb4 -
resource yara_rule behavioral1/memory/2032-0-0x00000000007D0000-0x000000000085C000-memory.dmp upx behavioral1/files/0x000a000000024448-2.dat upx behavioral1/memory/1172-3-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral1/memory/2032-18-0x00000000007D0000-0x000000000085C000-memory.dmp upx behavioral1/memory/1172-19-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral1/memory/1172-40-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1410a8 911f9fb4 File opened for modification C:\Windows\22c9e0 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911f9fb4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 911f9fb4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 911f9fb4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 911f9fb4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 911f9fb4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 911f9fb4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 911f9fb4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 911f9fb4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 911f9fb4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 911f9fb4 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1172 911f9fb4 1172 911f9fb4 1172 911f9fb4 1172 911f9fb4 1172 911f9fb4 1172 911f9fb4 1172 911f9fb4 1172 911f9fb4 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Token: SeTcbPrivilege 2032 f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe Token: SeDebugPrivilege 1172 911f9fb4 Token: SeTcbPrivilege 1172 911f9fb4
Processes
-
C:\Users\Admin\AppData\Local\Temp\f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe"C:\Users\Admin\AppData\Local\Temp\f621ad3bce2a2c1bcc06f1f8ce07587fac9206adecf3065679fd05ad7cae94ac.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
C:\Windows\Syswow64\911f9fb4C:\Windows\Syswow64\911f9fb41⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\911f9fb4
- Size 766KB
- SHA256 81d0e5ead8409f456af18f80d8b9a1ceeed42a970e6c89dd0c5b6346adde1348
- MD5 74cf9e6d1be671ba20fa4148d9b73774
- SHA1 808493191bf487f357a3a3328355e37582186840
- SHA512 3a889b4fa648a96ef688ea7e69c1e571d60f18f2ecd4a8affc989677161a5a08fafd418c426070111c9e3e279847144698b64dcf0a1e838af833093f83859038
- SSDEEP 12288:GSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:lvO2xJKRw2kOkx2LFRvcUV
- TLSH T197F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH