Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 19:55
Behavioral task
behavioral1
Sample
45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe
- Size 830KB
- Sample260924-ync54a1ckc
- SHA256 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d
- MD5 3c1e04fcef2e0f730841d79f80565eb3
- SHA1 76105f17c5ea3380ea11fb0c98eba6f747a938ae
- SHA512 b55ca4bf09d35303acc8559a3fb937bcf303486a61fd8902ad508fcb0fdc02c7cb92650ae781cffcdb93cb3246203354ff39dfb0def143475d5b5d634c719d67
- SSDEEP 12288:OSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:tvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T191055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5568 28a71b34 - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 35 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 36 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 89 114.114.114.114 5568 28a71b34 Destination IP 359 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 415 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 501 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 144 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 314 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 315 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 328 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 414 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 500 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 1 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 230 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 231 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 278 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 329 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 358 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 470 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 2 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 90 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 145 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 176 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 177 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 281 223.5.5.5 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Destination IP 469 114.114.114.114 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 28a71b34 File created C:\Windows\SysWOW64\28a71b34 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 28a71b34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 28a71b34 -
resource yara_rule behavioral2/memory/4896-0-0x00000000000D0000-0x000000000015C000-memory.dmp upx behavioral2/memory/5568-3-0x00000000006E0000-0x000000000076C000-memory.dmp upx behavioral2/files/0x000600000001b85a-4.dat upx behavioral2/memory/4896-20-0x00000000000D0000-0x000000000015C000-memory.dmp upx behavioral2/memory/5568-21-0x00000000006E0000-0x000000000076C000-memory.dmp upx behavioral2/memory/5568-46-0x00000000006E0000-0x000000000076C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5f5380 28a71b34 File opened for modification C:\Windows\53d240 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28a71b34 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 28a71b34 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 28a71b34 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 28a71b34 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 28a71b34 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 28a71b34 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 28a71b34 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 28a71b34 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 28a71b34 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 28a71b34 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5568 28a71b34 5568 28a71b34 5568 28a71b34 5568 28a71b34 5568 28a71b34 5568 28a71b34 5568 28a71b34 5568 28a71b34 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Token: SeTcbPrivilege 4896 45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe Token: SeDebugPrivilege 5568 28a71b34 Token: SeTcbPrivilege 5568 28a71b34
Processes
-
C:\Users\Admin\AppData\Local\Temp\45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe"C:\Users\Admin\AppData\Local\Temp\45e861a58113b769344793ff14a8cd8da8920ea511dfd5d3037cb019845f9e8d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
C:\Windows\Syswow64\28a71b34C:\Windows\Syswow64\28a71b341⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\28a71b34
- Size 830KB
- SHA256 aa9ec852b3b30e057aa937703b5ae3079318df2d084c17be3d6e16d35d54d3b2
- MD5 24c9ef53e201b4d8bd5370df6edc67f7
- SHA1 4919bb83efed96525d41d340216ed67448c0f28e
- SHA512 558e119c1f1ade432c7db20f50c9bc5b69525a3e6e6ac18db559d9b6509c8b5636dea163e3c387c9d6695221894ee6af0cfc019c41bfc4afd5212a3c1dfe5ceb
- SSDEEP 12288:YSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:zvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T177055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH