Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe
- Size 448KB
- Sample260930-xhrkvsvyfx
- SHA256 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55
- MD5 ddf3981105bf939e4b9bc8de79c10f1a
- SHA1 b5ab504428599b0ec747466772276236c2fc9e59
- SHA512 7c86f3094106d0cb7c56160ca6803c12dc0ec49f16c66850fc353f64bcc750b7e1d871a35c5037307cbd11685656f87597133ab9865bb9983d54554eb1d5dcda
- SSDEEP 6144:bcTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:bSvO2x9mONvKRILSF/Okx2LIatyD
- TLSH T1B8A45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4744 5ec6b5cc - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 376 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 129 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 236 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 292 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 1 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 40 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 41 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 235 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 293 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 323 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 377 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 95 114.114.114.114 4744 5ec6b5cc Destination IP 182 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 322 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 4 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 96 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 131 223.5.5.5 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Destination IP 181 114.114.114.114 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\5ec6b5cc 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5ec6b5cc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5ec6b5cc - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\513810 5ec6b5cc File opened for modification C:\Windows\4afcb8 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5ec6b5cc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5ec6b5cc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ec6b5cc - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5ec6b5cc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5ec6b5cc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5ec6b5cc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5ec6b5cc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5ec6b5cc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5ec6b5cc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5ec6b5cc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5ec6b5cc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5ec6b5cc - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4744 5ec6b5cc 4744 5ec6b5cc 4744 5ec6b5cc 4744 5ec6b5cc 4744 5ec6b5cc 4744 5ec6b5cc 4744 5ec6b5cc 4744 5ec6b5cc 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Token: SeTcbPrivilege 4380 2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe Token: SeDebugPrivilege 4744 5ec6b5cc Token: SeTcbPrivilege 4744 5ec6b5cc
Processes
-
C:\Users\Admin\AppData\Local\Temp\2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe"C:\Users\Admin\AppData\Local\Temp\2858be20cac2e018ce35ffb48a717c145d5cb717f2f88ca20a0354a9bc6a1f55.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
C:\Windows\Syswow64\5ec6b5ccC:\Windows\Syswow64\5ec6b5cc1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5ec6b5cc
- Size 448KB
- SHA256 367501406808b5998d18fabddf06c0a09eac98623fd1165b0598f95ac740a1a7
- MD5 380dc32accaaec1fe24c7941ef5cf7ca
- SHA1 34d19b74da977b124643c860e87e4d597376189c
- SHA512 e93c984e83c8d01945cda15d4f81c27e844de55028e794db35c13c5c1d39a7084f6fc77b328ef35eab13d76ad0b0e85015c26dd960e5e5e4f17b0182b4758df1
- SSDEEP 6144:CcTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:CSvO2x9mONvKRILSF/Okx2LIatyD
- TLSH T1D5A45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH