Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 06:38
Behavioral task
behavioral1
Sample
574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe
- Size 548KB
- Sample260925-hedr9ssblf
- SHA256 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6
- MD5 9c7ba03d8fba048c2251b8e2b315faaa
- SHA1 0704f17ca5246eb61c4832e8d85dd65941e63903
- SHA512 6bfef311c823dedec62857186c6e8dfe66764ba38bcaa2ee17b5602fed7682685867af3a077f851ac0251707d954302664684cc85c714ea4eff6a6b99c6e3a5d
- SSDEEP 6144:Zl51orRJXlDixHkUXe35rxcEOkCybEaQRXr9HNdvOa:nqXUHkUXe39xOkx2LIa
- TLSH T1D0C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4892 a47be429 - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 527 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 620 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 5 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 57 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 194 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 231 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 301 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 302 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 342 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 467 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 122 114.114.114.114 4892 a47be429 Destination IP 340 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 392 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 590 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 621 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 58 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 232 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 393 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 432 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 433 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 468 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 528 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 589 114.114.114.114 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 6 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 123 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 195 223.5.5.5 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a47be429 File created C:\Windows\SysWOW64\a47be429 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a47be429 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a47be429 -
resource yara_rule behavioral1/memory/4404-0-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral1/files/0x00080000000246ca-2.dat upx behavioral1/memory/4892-3-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4404-20-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral1/memory/4892-22-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4892-23-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4892-27-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4892-29-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4404-42-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral1/memory/4892-43-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4404-46-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral1/memory/4404-52-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral1/memory/4892-53-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4892-54-0x0000000000B20000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/4404-59-0x00000000004B0000-0x0000000000539000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\53c0b8 a47be429 File opened for modification C:\Windows\4b65e8 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a47be429 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a47be429 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a47be429 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a47be429 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a47be429 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a47be429 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a47be429 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a47be429 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a47be429 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a47be429 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4892 a47be429 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Token: SeTcbPrivilege 4404 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Token: SeDebugPrivilege 4892 a47be429 Token: SeTcbPrivilege 4892 a47be429
Processes
-
C:\Users\Admin\AppData\Local\Temp\574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe"C:\Users\Admin\AppData\Local\Temp\574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
C:\Windows\Syswow64\a47be429C:\Windows\Syswow64\a47be4291⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a47be429
- Size 548KB
- SHA256 218d710577808f6421e342b8daa55fc03caa9c495e44a27f471d3ba2501e3da0
- MD5 81c66c638f220d221245277f26ccf56b
- SHA1 cea6794353eb792bea6b7d439b108d4b3f31e8d9
- SHA512 219342bd06d3625393d01d06c553e1c27281d0cbf9b8930fef8f28091f7f499985adeba791a3d93c9f6f1f82a35132c6f0db3ce2b9766f166dfe4f056f79af36
- SSDEEP 6144:Wl51orRJXlDixHkUXe35rxcEOkCybEaQRXr9HNdvOa:eqXUHkUXe39xOkx2LIa
- TLSH T106C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH