Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 07:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe
- Size 1.6MB
- Sample261001-jf7bmsvfjf
- SHA256 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf
- MD5 79ff3caa310013ad4cccd48127a88d17
- SHA1 1e2edf4f634e853beafaa49e7c4fd5b7deec4114
- SHA512 fa2a884a728feea0a384282e56a29aad32e503b23a340a448868689507f735f785a230be95541db1faddcff38b221205a293e7031a73441d7025ea854f484cd3
- SSDEEP 24576:fvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+84FqoBsqMwLooSHazBvKRC:fHHKO29Qm5QZuTtS0rQM4PSxSFlv+a
- TLSH T1CD759E22E341C072D567117146BA0B7EA938BE62077495C7E3D4FD752F722E2AA3630E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4924 bb0a994f - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 288 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 289 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 291 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 324 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 95 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 235 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 323 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 93 114.114.114.114 4924 bb0a994f Destination IP 180 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 234 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 292 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 378 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 431 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 3 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 39 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 40 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 148 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 377 114.114.114.114 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 432 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 5 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 149 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Destination IP 181 223.5.5.5 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bb0a994f File created C:\Windows\SysWOW64\bb0a994f c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bb0a994f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bb0a994f - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\544cf8 bb0a994f File opened for modification C:\Windows\3194a0 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname bb0a994f Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain bb0a994f Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb0a994f - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bb0a994f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bb0a994f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bb0a994f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bb0a994f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bb0a994f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bb0a994f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bb0a994f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bb0a994f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bb0a994f - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4924 bb0a994f 4924 bb0a994f 4924 bb0a994f 4924 bb0a994f 4924 bb0a994f 4924 bb0a994f 4924 bb0a994f 4924 bb0a994f 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Token: SeTcbPrivilege 2896 c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe Token: SeDebugPrivilege 4924 bb0a994f Token: SeTcbPrivilege 4924 bb0a994f
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe"C:\Users\Admin\AppData\Local\Temp\c2c48c24cea246e9bf890cb092b52f4dbaa36127f619b010b88c96c2f1ee2ecf.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
C:\Windows\Syswow64\bb0a994fC:\Windows\Syswow64\bb0a994f1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\bb0a994f
- Size 1.6MB
- SHA256 f658f6695690deebc60ef915ab76697ebf37ff851d745ed9b9ff02490b53b632
- MD5 da364acc79ea60524121fa4fbb4263ea
- SHA1 65f62598c3fded3581e89c019d3cfb9f2ceb1410
- SHA512 a8ca58ca7d1bd77644a2d0208c9b21e11b5a679ba21ab0adb03116ce1ef1328af6e5ca2383a1d4a5b254d95662ef8c8c821f4f37bfd533b2f06809e9dea40d8c
- SSDEEP 24576:EvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+84FqoBsqMwLooSHazBvKRC:EHHKO29Qm5QZuTtS0rQM4PSxSFlv+a
- TLSH T181759E22E341C072D567117146BA0B7EA938BE62077495C7E3D4FD752F722E2AA3630E
- MD5 SHA1 SHA512 SSDEEP TLSH