Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe
- Size 448KB
- Sample260930-xdds7sww7r
- SHA256 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d
- MD5 62b145424d7bef5161df66139cbcc11c
- SHA1 adfe3d9812a17fa84c10f63bd31918496a676882
- SHA512 6245dfa8ca22d209614737ee821a7f25b541a2d44401517ce972f284d4b68c62f22eb5afbe72904726542d322c6224a494add86f1c2c2eeac7f1dc73cdde2f9a
- SSDEEP 6144:9cTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:9SvO2x9mONvKRILSF/Okx2LIatyD
- TLSH T12EA45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2496 da0474fa - Unexpected DNS network traffic destination 21 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 236 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 268 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 350 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 3 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 40 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 150 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 403 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 404 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 457 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 1 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 181 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 182 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 317 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 96 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 265 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 318 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 349 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 41 223.5.5.5 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 94 114.114.114.114 2496 da0474fa Destination IP 149 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Destination IP 235 114.114.114.114 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 da0474fa File created C:\Windows\SysWOW64\da0474fa d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE da0474fa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 da0474fa - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2abb80 da0474fa File opened for modification C:\Windows\59b5f0 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname da0474fa Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain da0474fa Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da0474fa - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix da0474fa Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" da0474fa Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ da0474fa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" da0474fa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" da0474fa Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing da0474fa Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" da0474fa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" da0474fa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" da0474fa - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2496 da0474fa 2496 da0474fa 2496 da0474fa 2496 da0474fa 2496 da0474fa 2496 da0474fa 2496 da0474fa 2496 da0474fa 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Token: SeTcbPrivilege 5240 d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe Token: SeDebugPrivilege 2496 da0474fa Token: SeTcbPrivilege 2496 da0474fa
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe"C:\Users\Admin\AppData\Local\Temp\d8db67c35db90d597499fb00406f275e7e0b2cc4f4786d18dc5884562b81926d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5240
-
C:\Windows\Syswow64\da0474faC:\Windows\Syswow64\da0474fa1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\da0474fa
- Size 448KB
- SHA256 5719301ff7bc1188ba3f9daa8efc0e15728d89cdcf0e2272571d8264c71448fd
- MD5 1c45f00730d97b0f82ba9a9364498298
- SHA1 40b36952a4fca65a3608e08d6f35f84cd113a9d5
- SHA512 6c9d107dbe29e4b421a39fce3f38aad0d9ad82927a3533cad66a3feb8d7fa24987366ce137c15ac68d9a94ece0f00ef7f160cada2a3a84ab0e04ef36801dfcf0
- SSDEEP 6144:scTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:sSvO2x9mONvKRILSF/Okx2LIatyD
- TLSH T1B6A45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH