Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 20:37
Behavioral task
behavioral1
Sample
fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe
- Size 1.2MB
- Sample260929-zee4rssz4m
- SHA256 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a
- MD5 331b63a853f48bafd89dc4b226e6ff01
- SHA1 3d6a5416e3850a99f68c649720b2b6d2c86578e7
- SHA512 51a46e098a2f9b7ca87249e58ae2fcccf189eee6553adc210b1182ccf69768e6ab224bb9be223ed3662282a4821ed2700f764923e216c7ac6b64372d59b5c7a8
- SSDEEP 24576:NvO2xJKRw2kOkx2LFRvhuZ98Es8k3OH3C0rQ6+y:NHHKe2WQXhuTtS0rQi
- TLSH T11E559E31E641C036D4A70176C6B94BBFA578BD22072555CBE3D43A6A2F723D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2808 1d6a92c1 - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 284 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 328 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 473 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 474 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 505 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 94 114.114.114.114 2808 1d6a92c1 Destination IP 181 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 235 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 236 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 319 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 320 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 3 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 40 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 182 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 327 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 413 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 504 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 95 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 149 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 150 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 357 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 358 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 414 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 5 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 41 223.5.5.5 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Destination IP 281 114.114.114.114 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1d6a92c1 File created C:\Windows\SysWOW64\1d6a92c1 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1d6a92c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1d6a92c1 -
resource yara_rule behavioral2/memory/5424-0-0x0000000000BE0000-0x0000000000C6C000-memory.dmp upx behavioral2/files/0x000f00000001b890-2.dat upx behavioral2/memory/2808-3-0x0000000000ED0000-0x0000000000F5C000-memory.dmp upx behavioral2/memory/5424-18-0x0000000000BE0000-0x0000000000C6C000-memory.dmp upx behavioral2/memory/2808-19-0x0000000000ED0000-0x0000000000F5C000-memory.dmp upx behavioral2/memory/2808-44-0x0000000000ED0000-0x0000000000F5C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3012f0 1d6a92c1 File opened for modification C:\Windows\5cdc60 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1d6a92c1 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1d6a92c1 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d6a92c1 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1d6a92c1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1d6a92c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1d6a92c1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1d6a92c1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1d6a92c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1d6a92c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1d6a92c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1d6a92c1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1d6a92c1 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2808 1d6a92c1 2808 1d6a92c1 2808 1d6a92c1 2808 1d6a92c1 2808 1d6a92c1 2808 1d6a92c1 2808 1d6a92c1 2808 1d6a92c1 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Token: SeTcbPrivilege 5424 fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe Token: SeDebugPrivilege 2808 1d6a92c1 Token: SeTcbPrivilege 2808 1d6a92c1
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe"C:\Users\Admin\AppData\Local\Temp\fbbe3bb975c6bdd76cd882110965a9f507fd81da8ed0dec367a6a4e0899fa86a.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5424
-
C:\Windows\Syswow64\1d6a92c1C:\Windows\Syswow64\1d6a92c11⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1d6a92c1
- Size 1.2MB
- SHA256 39fa0023d7c432388457b7a1262c365246461d9d1ca476a3a28b976780127afc
- MD5 17fac6620071845d31fa0f0725bfdfd0
- SHA1 5e966c8768a99f8945ec6264879dc407f525e3cf
- SHA512 d5b9a9d0663aaf7c761fcc54792e6c19dd12e54c0639408ccae4e546b94aaa4f5711ab1a6105539714f5eace9107dbcf97192341d611b1fa7edfdd8001faf62c
- SSDEEP 24576:ZvO2xJKRw2kOkx2LFRvhuZ98Es8k3OH3C0rQ6+y:ZHHKe2WQXhuTtS0rQi
- TLSH T18D559E31E641C036D4A70176C6B94BBFA578BD22072555CBE3D43A6A2F722D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH