Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/09/2026, 22:34
Behavioral task
behavioral1
Sample
10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe
- Size 560KB
- Sample260926-2g4agsshkb
- SHA256 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b
- MD5 7331836d50424bf9e01ff22f7f2be25a
- SHA1 0d093c0d62d732c90ff41b0e63a7bbece24caad0
- SHA512 4094452ffe00b7174cd4d8a027913e7398358d472ef79d0f68de14424198a5aecc44760fa42261f6c9388a0ed41fe484349e4975ff40a2786c36fe7765edcaa7
- SSDEEP 12288:M3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:AVOL4/gPXKCOkx2LFR
- TLSH T1B1C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 6004 1947e26f - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 94 114.114.114.114 6004 1947e26f Destination IP 236 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 281 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 405 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 96 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 149 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 181 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 182 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 320 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 350 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 40 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 235 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 283 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 406 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 150 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 319 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 352 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 1 114.114.114.114 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 2 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Destination IP 41 223.5.5.5 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1947e26f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1947e26f File created C:\Windows\SysWOW64\1947e26f 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1947e26f -
resource yara_rule behavioral2/memory/1440-0-0x0000000000E60000-0x0000000000EEC000-memory.dmp upx behavioral2/files/0x000c00000001b869-2.dat upx behavioral2/memory/6004-3-0x0000000000480000-0x000000000050C000-memory.dmp upx behavioral2/memory/1440-18-0x0000000000E60000-0x0000000000EEC000-memory.dmp upx behavioral2/memory/6004-19-0x0000000000480000-0x000000000050C000-memory.dmp upx behavioral2/memory/6004-42-0x0000000000480000-0x000000000050C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\66ca68 1947e26f File opened for modification C:\Windows\18a740 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1947e26f Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1947e26f Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1947e26f Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1947e26f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1947e26f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1947e26f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1947e26f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1947e26f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1947e26f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1947e26f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1947e26f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1947e26f - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 6004 1947e26f 6004 1947e26f 6004 1947e26f 6004 1947e26f 6004 1947e26f 6004 1947e26f 6004 1947e26f 6004 1947e26f 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Token: SeTcbPrivilege 1440 10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe Token: SeDebugPrivilege 6004 1947e26f Token: SeTcbPrivilege 6004 1947e26f
Processes
-
C:\Users\Admin\AppData\Local\Temp\10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe"C:\Users\Admin\AppData\Local\Temp\10ca13ee517704a01ec87df28d5b26f856d51a9c9cc1d169cc9727bc465bf58b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
C:\Windows\Syswow64\1947e26fC:\Windows\Syswow64\1947e26f1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1947e26f
- Size 560KB
- SHA256 78f12da7bab9c72b636fd5caea1458bee2ab27055fd88234f5ebd0ea70a1c36e
- MD5 a79355e3760ca878bffa9c0b3a9457d1
- SHA1 2ccacbc26d6335909c89aea30629dc6d8a444888
- SHA512 06acb4edd6279881ab64cdad101724fe247b3f6bfe4ae89ab2257caa81d6e831a07514ad48b00719eabea687fb34573343074977973a586c1b13d26b6208e93d
- SSDEEP 12288:i3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:yVOL4/gPXKCOkx2LFR
- TLSH T1EBC46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH