Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 20:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe
- Size 374KB
- Sample260929-y3ebpsybmg
- SHA256 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00
- MD5 c4078068b155c1624b920781feac143e
- SHA1 b26145216231ce2291b70c1e195f8da7b792f4c8
- SHA512 23865186a98502eb4a19e1d0a740bd6e6a846a748aaab958e391cb5fbbbd9893fb5fd3d6f9db2a1fdd64f2cbeee6c4dd2f769d2ea027e397d156e692f1b89d72
- SSDEEP 6144:qcTgav1cdCTuoPbgwmOLJvKRILSFvdFfcEOkCybEaQRXr9HNdvOaxy8K:qSvO2x9mONvKRILSFLOkx2LIaxy
- TLSH T12B846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5360 98ba24b0 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 234 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 321 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 376 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 292 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 2 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 95 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 180 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 40 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 94 114.114.114.114 5360 98ba24b0 Destination IP 235 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 322 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 375 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 39 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 128 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 129 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 181 223.5.5.5 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Destination IP 291 114.114.114.114 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\98ba24b0 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 98ba24b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 98ba24b0 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5bc3e0 98ba24b0 File opened for modification C:\Windows\3f46e0 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 98ba24b0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 98ba24b0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98ba24b0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 98ba24b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 98ba24b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 98ba24b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 98ba24b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 98ba24b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 98ba24b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 98ba24b0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 98ba24b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 98ba24b0 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5360 98ba24b0 5360 98ba24b0 5360 98ba24b0 5360 98ba24b0 5360 98ba24b0 5360 98ba24b0 5360 98ba24b0 5360 98ba24b0 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Token: SeTcbPrivilege 3696 3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe Token: SeDebugPrivilege 5360 98ba24b0 Token: SeTcbPrivilege 5360 98ba24b0
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe"C:\Users\Admin\AppData\Local\Temp\3c3f4ea3b57d62ffdd258b764d5639d4d915ba75b1f5c89b70b37719189d7e00.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
C:\Windows\Syswow64\98ba24b0C:\Windows\Syswow64\98ba24b01⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\98ba24b0
- Size 374KB
- SHA256 5ae15fccc88fab5ffaf3ca28a8e6da5bc92be517b947ce8d60a8a4c6f279561d
- MD5 780149a2cf63ec1d01f8b96f307478c5
- SHA1 bc4cb306f85cae9d39dae40c7fab18b081e31c0c
- SHA512 ecf129289e2b404bb9b02e18756e895c0382b5cde08564c6e3342ae56db69731a41aef3a6e5138078b21761d373a9accf29ccc2594e0dae10c05d860c0134a9c
- SSDEEP 6144:HcTgav1cdCTuoPbgwmOLJvKRILSFvdFfcEOkCybEaQRXr9HNdvOaxy8K:HSvO2x9mONvKRILSFLOkx2LIaxy
- TLSH T1D5846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH