Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 07:51
Behavioral task
behavioral1
Sample
b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe
- Size 1024KB
- Sample260925-jp6fpssgla
- SHA256 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1
- MD5 359380f229b76cbd1b3fa758c7708bd1
- SHA1 95e615bee572200e120a80795ac72e54162e7ab3
- SHA512 0aa6df2f60d48839bd18575b232f319ab0272c548de113b75bd2f9ffff855ce454914629373a0f96a34cfd220d94c135b716b00a1996bb0c3eddb9a50a29f273
- SSDEEP 24576:ZjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:ZTGkQyhuTtS0rQi
- TLSH T12725AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3548 79f242ac - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 96 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 151 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 182 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 237 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 41 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 183 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 289 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 291 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 313 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 452 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 453 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 312 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 344 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 398 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 399 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 5 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 42 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 95 114.114.114.114 3548 79f242ac Destination IP 150 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 236 114.114.114.114 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 345 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Destination IP 7 223.5.5.5 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 79f242ac File created C:\Windows\SysWOW64\79f242ac b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 79f242ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 79f242ac -
resource yara_rule behavioral2/memory/2524-0-0x0000000000F30000-0x0000000000FB9000-memory.dmp upx behavioral2/files/0x0012000000011559-2.dat upx behavioral2/memory/3548-3-0x00000000000C0000-0x0000000000149000-memory.dmp upx behavioral2/memory/2524-18-0x0000000000F30000-0x0000000000FB9000-memory.dmp upx behavioral2/memory/3548-20-0x00000000000C0000-0x0000000000149000-memory.dmp upx behavioral2/memory/3548-24-0x00000000000C0000-0x0000000000149000-memory.dmp upx behavioral2/memory/3548-26-0x00000000000C0000-0x0000000000149000-memory.dmp upx behavioral2/memory/2524-43-0x0000000000F30000-0x0000000000FB9000-memory.dmp upx behavioral2/memory/3548-44-0x00000000000C0000-0x0000000000149000-memory.dmp upx behavioral2/memory/2524-47-0x0000000000F30000-0x0000000000FB9000-memory.dmp upx behavioral2/memory/2524-51-0x0000000000F30000-0x0000000000FB9000-memory.dmp upx behavioral2/memory/3548-52-0x00000000000C0000-0x0000000000149000-memory.dmp upx behavioral2/memory/2524-61-0x0000000000F30000-0x0000000000FB9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2b3638 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe File opened for modification C:\Windows\3cbe38 79f242ac - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79f242ac - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 79f242ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 79f242ac Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 79f242ac Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 79f242ac Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 79f242ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 79f242ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 79f242ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 79f242ac Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 79f242ac - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3548 79f242ac 3548 79f242ac 3548 79f242ac 3548 79f242ac 3548 79f242ac 3548 79f242ac 3548 79f242ac 3548 79f242ac 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Token: SeTcbPrivilege 2524 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe Token: SeDebugPrivilege 3548 79f242ac Token: SeTcbPrivilege 3548 79f242ac
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe"C:\Users\Admin\AppData\Local\Temp\b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
C:\Windows\Syswow64\79f242acC:\Windows\Syswow64\79f242ac1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\79f242ac
- Size 1024KB
- SHA256 f6619cb309764bc300045fd418c97a0edc7e9aa71ac6b9caa378bd2af1bfbfbb
- MD5 c6e870a1924f78a3b35b0c94ef5c2b2e
- SHA1 add4d310c09999dad1d3ffd8dcbd227af3547da0
- SHA512 d15efc2964aa1a03ee4f5751135bbf920e867d8d8efad6b5775c282c9107dbd9368f80af0a416cffd810bda4a97ec529c3a9e9cac55f2bb8804c84fdc3abad45
- SSDEEP 24576:ajHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:aTGkQyhuTtS0rQi
- TLSH T1D825AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH