Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe
- Size 1.7MB
- Sample260930-xfd7rawy6m
- SHA256 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6
- MD5 3b128499210d425f7a90dad9b962afd0
- SHA1 79588f2f7a7cc1aa3d4dd1c01089f1e13fc2c8e9
- SHA512 554fe2c7ed6eda62a55d0b5311706043a92f836a5856baa82f12c83e360de64c00eb6de41c080ab6618d8aba3a0197bb8e9e241433f70440c901227a7856baa5
- SSDEEP 24576:qvO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:qHHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T1EA858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3152 26011ea4 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 93 114.114.114.114 3152 26011ea4 Destination IP 148 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 181 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 234 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 456 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 235 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 282 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 314 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 346 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 400 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 455 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 39 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 149 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 180 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 347 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 401 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 4 114.114.114.114 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 6 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 40 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 95 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 284 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Destination IP 315 223.5.5.5 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 26011ea4 File created C:\Windows\SysWOW64\26011ea4 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 26011ea4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 26011ea4 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\35f6a0 26011ea4 File opened for modification C:\Windows\54eac0 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 26011ea4 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 26011ea4 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26011ea4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 26011ea4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 26011ea4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 26011ea4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 26011ea4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 26011ea4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 26011ea4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 26011ea4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 26011ea4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 26011ea4 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3152 26011ea4 3152 26011ea4 3152 26011ea4 3152 26011ea4 3152 26011ea4 3152 26011ea4 3152 26011ea4 3152 26011ea4 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Token: SeTcbPrivilege 4960 6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe Token: SeDebugPrivilege 3152 26011ea4 Token: SeTcbPrivilege 3152 26011ea4
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe"C:\Users\Admin\AppData\Local\Temp\6ac0cff8c4dfd5cffa446b0cf565b07cbbc4ea37684b979ad58ad84d7e8b8ca6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Windows\Syswow64\26011ea4C:\Windows\Syswow64\26011ea41⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\26011ea4
- Size 1.7MB
- SHA256 b66cc1a57297f08b5f1952a5bd9e7dc757977a6c54bf9d8e55f8bc81d6c48e40
- MD5 d24a3a546c44404d9cff6f3d5b94c244
- SHA1 8afc03234afffe4070e65d225bd27c7a8f741828
- SHA512 e6dafac2f641c853e2b9e44ecaeeff3e9c96b9319eeeb484fe401d3c42dd1a96e505387413cbb03bb4655b7b05785c459be2ca5d436067b7059ec41eb9b17e08
- SSDEEP 24576:1vO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:1HHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T149858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH