Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 19:55
Behavioral task
behavioral1
Sample
45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe
- Size 830KB
- Sample260924-ync54a1ckc
- SHA256 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d
- MD5 3c1e04fcef2e0f730841d79f80565eb3
- SHA1 76105f17c5ea3380ea11fb0c98eba6f747a938ae
- SHA512 b55ca4bf09d35303acc8559a3fb937bcf303486a61fd8902ad508fcb0fdc02c7cb92650ae781cffcdb93cb3246203354ff39dfb0def143475d5b5d634c719d67
- SSDEEP 12288:OSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:tvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T191055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1636 f0c2fcad - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 488 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 3 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 131 114.114.114.114 1636 f0c2fcad Destination IP 241 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 301 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 393 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 4 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 67 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 240 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 362 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 392 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 489 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 203 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 302 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 548 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 549 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 66 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 132 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 204 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 360 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 427 114.114.114.114 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 428 223.5.5.5 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f0c2fcad File created C:\Windows\SysWOW64\f0c2fcad 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f0c2fcad File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f0c2fcad -
resource yara_rule behavioral1/memory/1596-0-0x0000000000730000-0x00000000007BC000-memory.dmp upx behavioral1/files/0x0013000000024346-2.dat upx behavioral1/memory/1636-4-0x0000000000BA0000-0x0000000000C2C000-memory.dmp upx behavioral1/memory/1596-18-0x0000000000730000-0x00000000007BC000-memory.dmp upx behavioral1/memory/1636-19-0x0000000000BA0000-0x0000000000C2C000-memory.dmp upx behavioral1/memory/1636-38-0x0000000000BA0000-0x0000000000C2C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1c0248 f0c2fcad File opened for modification C:\Windows\1b52f8 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0c2fcad - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f0c2fcad Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f0c2fcad Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f0c2fcad Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f0c2fcad Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f0c2fcad Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f0c2fcad Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f0c2fcad Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f0c2fcad Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f0c2fcad - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1636 f0c2fcad 1636 f0c2fcad 1636 f0c2fcad 1636 f0c2fcad 1636 f0c2fcad 1636 f0c2fcad 1636 f0c2fcad 1636 f0c2fcad 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Token: SeTcbPrivilege 1596 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Token: SeDebugPrivilege 1636 f0c2fcad Token: SeTcbPrivilege 1636 f0c2fcad
Processes
-
C:\Users\Admin\AppData\Local\Temp\45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe"C:\Users\Admin\AppData\Local\Temp\45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
C:\Windows\Syswow64\f0c2fcadC:\Windows\Syswow64\f0c2fcad1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\f0c2fcad
- Size 830KB
- SHA256 f1bd00e3b7f87fcdbd95711fd6988c2bf3b55e5031869d926bb5571b4133cf1d
- MD5 fcf81933a83848fcd514089dc750a5b8
- SHA1 c04cf44aa69c3e40a5086bd0e695358fc5d72bbd
- SHA512 f4e0fa3cba280f56fc82fb290ef15b822b8a72278fc9852aa549cc2f1b5ced1e35ce635f5b999eca9eabf2fdd42aeeb5e3bf51ce26abc1241a7b29a3dbab8007
- SSDEEP 12288:MSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:/vO2xJKRw2kOkx2LFRvcUQPK
- TLSH T150055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH