Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:37
Behavioral task
behavioral1
Sample
1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe
- Size 830KB
- Sample260925-w9ngvagg93
- SHA256 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c
- MD5 281931f0156ba5b25ecf20388ff75fd4
- SHA1 1809031d521bc70a76057f386939c5bf8d12fa12
- SHA512 f825af7a1f7f988c32807a305848391a98ab8e5d5ad256af0f848125e56d3da6ffca5fc0ea7906a4476725931af1c8cc352f427843fff1a82f119d2b3fc8dcd4
- SSDEEP 12288:mSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:FvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T1B6055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3492 d98e62e0 - Unexpected DNS network traffic destination 29 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 235 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 283 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 372 114.114.114.114 3492 d98e62e0 Destination IP 522 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 609 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 1 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 148 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 149 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 464 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 39 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 93 114.114.114.114 3492 d98e62e0 Destination IP 94 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 318 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 375 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 4 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 40 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 181 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 405 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 610 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 319 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 374 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 285 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 404 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 465 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 521 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 180 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 234 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 552 114.114.114.114 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Destination IP 553 223.5.5.5 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d98e62e0 File created C:\Windows\SysWOW64\d98e62e0 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d98e62e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d98e62e0 -
resource yara_rule behavioral2/memory/3348-0-0x00000000001A0000-0x000000000022C000-memory.dmp upx behavioral2/files/0x000b00000001b302-2.dat upx behavioral2/memory/3492-4-0x0000000000EC0000-0x0000000000F4C000-memory.dmp upx behavioral2/memory/3348-18-0x00000000001A0000-0x000000000022C000-memory.dmp upx behavioral2/memory/3492-19-0x0000000000EC0000-0x0000000000F4C000-memory.dmp upx behavioral2/memory/3492-44-0x0000000000EC0000-0x0000000000F4C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3bc8c8 d98e62e0 File opened for modification C:\Windows\3951a8 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d98e62e0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d98e62e0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d98e62e0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d98e62e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d98e62e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d98e62e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d98e62e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d98e62e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d98e62e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d98e62e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d98e62e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d98e62e0 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3492 d98e62e0 3492 d98e62e0 3492 d98e62e0 3492 d98e62e0 3492 d98e62e0 3492 d98e62e0 3492 d98e62e0 3492 d98e62e0 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Token: SeTcbPrivilege 3348 1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe Token: SeDebugPrivilege 3492 d98e62e0 Token: SeTcbPrivilege 3492 d98e62e0
Processes
-
C:\Users\Admin\AppData\Local\Temp\1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe"C:\Users\Admin\AppData\Local\Temp\1598313c44018dad08c5201c82f7078959284583ce789a32ddd898b6219eb76c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
C:\Windows\Syswow64\d98e62e0C:\Windows\Syswow64\d98e62e01⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d98e62e0
- Size 830KB
- SHA256 cc6d3b3a8077ee369b6e954c54b236a5bfe3215aeb1db78599f1c262f9ce90ce
- MD5 88fee168b54ea15ea3f2419cd0fce31c
- SHA1 cf03da078181184bcd14bcfca6fad1c4ee9f6bd0
- SHA512 b346147f97f6cb10795387453916f36d1116f5469c39eb1aca01404b9b8722d0f3e64231b77a67aeebb1fe7d5928a9a5948f329e5cb9a3ceb495e4185d6e5ca9
- SSDEEP 12288:sSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:fvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T128055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH