Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 07:51
Behavioral task
behavioral1
Sample
b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe
- Size 1024KB
- Sample260925-jp6fpssgla
- SHA256 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1
- MD5 359380f229b76cbd1b3fa758c7708bd1
- SHA1 95e615bee572200e120a80795ac72e54162e7ab3
- SHA512 0aa6df2f60d48839bd18575b232f319ab0272c548de113b75bd2f9ffff855ce454914629373a0f96a34cfd220d94c135b716b00a1996bb0c3eddb9a50a29f273
- SSDEEP 24576:ZjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:ZTGkQyhuTtS0rQi
- TLSH T12725AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2272 c1da4e7 - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 383 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 474 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 56 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 191 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 301 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 413 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 414 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 475 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 3 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 4 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 42 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 194 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 240 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 348 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 121 114.114.114.114 2272 c1da4e7 Destination IP 122 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 300 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 232 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 351 223.5.5.5 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 382 114.114.114.114 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c1da4e7 File created C:\Windows\SysWOW64\c1da4e7 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c1da4e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c1da4e7 -
resource yara_rule behavioral1/memory/868-0-0x0000000000110000-0x0000000000199000-memory.dmp upx behavioral1/files/0x00060000000004ee-2.dat upx behavioral1/memory/2272-7-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral1/memory/868-18-0x0000000000110000-0x0000000000199000-memory.dmp upx behavioral1/memory/2272-20-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral1/memory/2272-21-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral1/memory/2272-27-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral1/memory/868-40-0x0000000000110000-0x0000000000199000-memory.dmp upx behavioral1/memory/2272-41-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral1/memory/868-48-0x0000000000110000-0x0000000000199000-memory.dmp upx behavioral1/memory/2272-49-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral1/memory/868-51-0x0000000000110000-0x0000000000199000-memory.dmp upx behavioral1/memory/868-56-0x0000000000110000-0x0000000000199000-memory.dmp upx behavioral1/memory/868-59-0x0000000000110000-0x0000000000199000-memory.dmp upx behavioral1/memory/868-62-0x0000000000110000-0x0000000000199000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\26e5c0 c1da4e7 File opened for modification C:\Windows\edc48 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1da4e7 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c1da4e7 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c1da4e7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c1da4e7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c1da4e7 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c1da4e7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c1da4e7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c1da4e7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c1da4e7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c1da4e7 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2272 c1da4e7 2272 c1da4e7 2272 c1da4e7 2272 c1da4e7 2272 c1da4e7 2272 c1da4e7 2272 c1da4e7 2272 c1da4e7 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Token: SeTcbPrivilege 868 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Token: SeDebugPrivilege 2272 c1da4e7 Token: SeTcbPrivilege 2272 c1da4e7
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe"C:\Users\Admin\AppData\Local\Temp\b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868
-
C:\Windows\Syswow64\c1da4e7C:\Windows\Syswow64\c1da4e71⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c1da4e7
- Size 1024KB
- SHA256 04b5fd433a7d36f2ed45b3ef26b462e7aed7b5c79b0c47013b9a5b1b77bf4049
- MD5 f961be841af85bc82531dd4d9b000581
- SHA1 650ff29e430a9a0fbf6a7bce9208f37a6d665de8
- SHA512 f06a9ea9958aaae7835970be599db9c457a122b532e25270fc3cb2597a7f6f302149ae2db6e2b459e51755d919954c4ba88f8d2e1a66dfd46f5121145c41992d
- SSDEEP 24576:ujHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:uTGkQyhuTtS0rQi
- TLSH T1B625AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH