Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 20:37
Behavioral task
behavioral1
Sample
f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe
- Size 761KB
- Sample261001-zedkyabc78
- SHA256 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903
- MD5 6f839be90fba89ea50b54a283f5f599e
- SHA1 e885404bcfa4970f5c99e8fb2f4ae74d2a4bbdc8
- SHA512 4c6ca2b92b2861f2f63b3f3f8e79d226017b9350c8479ddfc1fc88f76ea33dfd3120fff0a91b85590bd17b9a18ffb33d0b874359796b96bc44ada805e3b7e8f8
- SSDEEP 12288:YSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:zvO2xJKRw2kOkxSkW298B
- TLSH T1A7F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1580 5c6346f0 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 167 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 369 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 4 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 56 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 57 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 121 114.114.114.114 1580 5c6346f0 Destination IP 171 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 301 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 300 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 370 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 400 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 239 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 240 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 401 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 461 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 462 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 2 114.114.114.114 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Destination IP 122 223.5.5.5 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\5c6346f0 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5c6346f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5c6346f0 -
resource yara_rule behavioral1/memory/2392-0-0x0000000000310000-0x000000000039C000-memory.dmp upx behavioral1/files/0x000a000000023340-2.dat upx behavioral1/memory/1580-4-0x00000000007D0000-0x000000000085C000-memory.dmp upx behavioral1/memory/2392-18-0x0000000000310000-0x000000000039C000-memory.dmp upx behavioral1/memory/1580-19-0x00000000007D0000-0x000000000085C000-memory.dmp upx behavioral1/memory/1580-36-0x00000000007D0000-0x000000000085C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1b0cd8 5c6346f0 File opened for modification C:\Windows\28f3b0 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5c6346f0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5c6346f0 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c6346f0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5c6346f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5c6346f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5c6346f0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5c6346f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5c6346f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5c6346f0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5c6346f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5c6346f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5c6346f0 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1580 5c6346f0 1580 5c6346f0 1580 5c6346f0 1580 5c6346f0 1580 5c6346f0 1580 5c6346f0 1580 5c6346f0 1580 5c6346f0 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Token: SeTcbPrivilege 2392 f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe Token: SeDebugPrivilege 1580 5c6346f0 Token: SeTcbPrivilege 1580 5c6346f0
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe"C:\Users\Admin\AppData\Local\Temp\f0be93a0315c6db5b3706b04f67f3fa8651762513a65856e82dd4f7ee58df903.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
C:\Windows\Syswow64\5c6346f0C:\Windows\Syswow64\5c6346f01⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5c6346f0
- Size 761KB
- SHA256 4764baa766c7363f29d2657f2d2706c958196e75022cc84f785bcba8a047b050
- MD5 81c844b17f1e7778003e1fbcdbfc0528
- SHA1 00c2d98bfe5db7718b78c9711b823caadacf9959
- SHA512 56b50c54aa228e223998641985af892da07d1c3a84824a968af32b0a86dc11d2d4b3632886f5f8df426920d583782575ae0f8522ff639b7c217499136d288c29
- SSDEEP 12288:3SvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:CvO2xJKRw2kOkxSkW298B
- TLSH T19BF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH