Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 18:40
Behavioral task
behavioral1
Sample
043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe
- Size 560KB
- Sample260925-xbhdlsgh52
- SHA256 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f
- MD5 f1f7a534a310d7f6078180f69d9d1d12
- SHA1 e790dbe137eccff56188286948b0f525cdf15a2f
- SHA512 816704561b75c3eab19d43c43e582ed2c176fb3c18032eddd0ac86a3fc19ed24df6a16e5dcb8a8dbb844e88402ee2c5ec074bbaff60e3729e2211b2553751d2c
- SSDEEP 6144:s4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:srNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T1F6C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2896 2a11fa5a - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 193 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 299 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 413 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 238 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 338 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 474 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 475 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 5 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 55 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 192 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 300 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 382 114.114.114.114 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 383 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 414 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 6 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 120 114.114.114.114 2896 2a11fa5a Destination IP 121 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 239 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 340 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Destination IP 56 223.5.5.5 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2a11fa5a File created C:\Windows\SysWOW64\2a11fa5a 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 2a11fa5a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 2a11fa5a -
resource yara_rule behavioral1/memory/5008-0-0x0000000000820000-0x00000000008AC000-memory.dmp upx behavioral1/files/0x00080000000004eb-2.dat upx behavioral1/memory/2896-4-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral1/memory/5008-18-0x0000000000820000-0x00000000008AC000-memory.dmp upx behavioral1/memory/2896-19-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral1/memory/2896-38-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3194a0 2a11fa5a File opened for modification C:\Windows\55bd20 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2a11fa5a Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2a11fa5a Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a11fa5a - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2a11fa5a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2a11fa5a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2a11fa5a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2a11fa5a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 2a11fa5a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2a11fa5a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2a11fa5a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2a11fa5a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2a11fa5a - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2896 2a11fa5a 2896 2a11fa5a 2896 2a11fa5a 2896 2a11fa5a 2896 2a11fa5a 2896 2a11fa5a 2896 2a11fa5a 2896 2a11fa5a 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Token: SeTcbPrivilege 5008 043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe Token: SeDebugPrivilege 2896 2a11fa5a Token: SeTcbPrivilege 2896 2a11fa5a
Processes
-
C:\Users\Admin\AppData\Local\Temp\043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe"C:\Users\Admin\AppData\Local\Temp\043315cea7367b31ccc5e45e877a2126d4491285583a8ccfd9b1a38b1a793a4f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
C:\Windows\Syswow64\2a11fa5aC:\Windows\Syswow64\2a11fa5a1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\2a11fa5a
- Size 560KB
- SHA256 d70a89f35e8128e08ba6df5134f78778c8f81bece61191c654a9b563232ffb73
- MD5 41e99368d085ac0af17dfd27710cdfbe
- SHA1 fa396bb628264c351372777e1ea7b141abaf704d
- SHA512 6736b70101bb577412e4c0941303072aff42b88ee107416ff1bc3cb645a827432a56a98e3652f8159f833ea8e11295ab60f65285c91464a96023c4861d38bb2f
- SSDEEP 6144:j4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:jrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T1E3C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH