Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 06:38
Behavioral task
behavioral1
Sample
574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe
- Size 548KB
- Sample260925-hedr9ssblf
- SHA256 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6
- MD5 9c7ba03d8fba048c2251b8e2b315faaa
- SHA1 0704f17ca5246eb61c4832e8d85dd65941e63903
- SHA512 6bfef311c823dedec62857186c6e8dfe66764ba38bcaa2ee17b5602fed7682685867af3a077f851ac0251707d954302664684cc85c714ea4eff6a6b99c6e3a5d
- SSDEEP 6144:Zl51orRJXlDixHkUXe35rxcEOkCybEaQRXr9HNdvOa:nqXUHkUXe39xOkx2LIa
- TLSH T1D0C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3548 ba78ae84 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 181 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 337 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 338 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 40 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 41 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 149 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 182 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 235 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 305 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 306 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 445 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 1 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 94 114.114.114.114 3548 ba78ae84 Destination IP 96 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 150 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 282 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 285 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 391 114.114.114.114 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 446 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 236 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Destination IP 392 223.5.5.5 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ba78ae84 File created C:\Windows\SysWOW64\ba78ae84 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ba78ae84 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ba78ae84 -
resource yara_rule behavioral2/memory/5240-0-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral2/files/0x000900000001b846-2.dat upx behavioral2/memory/3548-3-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/5240-18-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral2/memory/3548-20-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/3548-21-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/3548-25-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/3548-27-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/5240-44-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral2/memory/3548-45-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/5240-52-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral2/memory/3548-53-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/3548-54-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral2/memory/5240-55-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral2/memory/5240-65-0x0000000000860000-0x00000000008E9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3cbe38 ba78ae84 File opened for modification C:\Windows\59b5f0 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba78ae84 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ba78ae84 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ba78ae84 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ba78ae84 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ba78ae84 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ba78ae84 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ba78ae84 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ba78ae84 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ba78ae84 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ba78ae84 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3548 ba78ae84 3548 ba78ae84 3548 ba78ae84 3548 ba78ae84 3548 ba78ae84 3548 ba78ae84 3548 ba78ae84 3548 ba78ae84 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Token: SeTcbPrivilege 5240 574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe Token: SeDebugPrivilege 3548 ba78ae84 Token: SeTcbPrivilege 3548 ba78ae84
Processes
-
C:\Users\Admin\AppData\Local\Temp\574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe"C:\Users\Admin\AppData\Local\Temp\574886c87deaff9c2bcb22f707e1da5cd3aff9faa9f0bfc188948e61a85915e6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5240
-
C:\Windows\Syswow64\ba78ae84C:\Windows\Syswow64\ba78ae841⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ba78ae84
- Size 548KB
- SHA256 05b5e6a209286b8fcb9f1e4f749f560e18bd192db2d84075b10c80f62a4539b8
- MD5 f7f47ed6892a20b17d6ee3c5424c3f52
- SHA1 b8cd65deb564c0aaf257eadf150229ccd33b1d9a
- SHA512 177e567d287ceceac8b89f232a8eeb3248935820f07ba93f9c4bc4b36d31e28a59f6da4f6bb3949e115f366073ab4c0a8bbd731d0ea3bf20af3fd5fa2ac75f29
- SSDEEP 6144:9l51orRJXlDixHkUXe35rxcEOkCybEaQRXr9HNdvOa:7qXUHkUXe39xOkx2LIa
- TLSH T1F9C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH