Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 20:56
Behavioral task
behavioral1
Sample
90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe
- Size 766KB
- Sample261001-zrf7layerb
- SHA256 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc
- MD5 4dad2dc2099fd8d003a1c9db7ed03d3d
- SHA1 9a06af0f4fdfa81a6ad82a6e9997b4ae13d7a5db
- SHA512 c16574b46877dc18421a87510d6af183065bce47caa17ddcbfa2d7701192abc433937f22f6f43bba247fc2af8501689acdc743a0153ef0a13d512d00dadc3056
- SSDEEP 12288:QSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:LvO2xJKRw2kOkx2LFRvcUV
- TLSH T15CF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4724 25609d40 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 477 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 538 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 4 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 57 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 242 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 302 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 363 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 416 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 122 114.114.114.114 4724 25609d40 Destination IP 193 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 241 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 303 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 385 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 123 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 192 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 362 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 478 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 537 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 3 114.114.114.114 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 58 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 386 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Destination IP 417 223.5.5.5 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\25609d40 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 25609d40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 25609d40 -
resource yara_rule behavioral1/memory/4912-0-0x00000000005B0000-0x000000000063C000-memory.dmp upx behavioral1/files/0x00060000000004ec-2.dat upx behavioral1/memory/4724-4-0x0000000000060000-0x00000000000EC000-memory.dmp upx behavioral1/memory/4912-18-0x00000000005B0000-0x000000000063C000-memory.dmp upx behavioral1/memory/4724-19-0x0000000000060000-0x00000000000EC000-memory.dmp upx behavioral1/memory/4724-38-0x0000000000060000-0x00000000000EC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\50e068 25609d40 File opened for modification C:\Windows\541860 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 25609d40 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 25609d40 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25609d40 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 25609d40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 25609d40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 25609d40 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 25609d40 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 25609d40 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 25609d40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 25609d40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 25609d40 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 25609d40 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4724 25609d40 4724 25609d40 4724 25609d40 4724 25609d40 4724 25609d40 4724 25609d40 4724 25609d40 4724 25609d40 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Token: SeTcbPrivilege 4912 90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe Token: SeDebugPrivilege 4724 25609d40 Token: SeTcbPrivilege 4724 25609d40
Processes
-
C:\Users\Admin\AppData\Local\Temp\90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe"C:\Users\Admin\AppData\Local\Temp\90dd3cb920e7aaa02a0ed3291d966c638d9f87583bf4ee4f8c7a866f2e16b9fc.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
C:\Windows\Syswow64\25609d40C:\Windows\Syswow64\25609d401⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\25609d40
- Size 766KB
- SHA256 b91bae2e32b94689b98b5c1e9a33f60abada27c7d2ea620c49712823072fdce1
- MD5 8e48e31086653f27d7ea48db7a12e6e0
- SHA1 876e25f11c1aee6086dbfd33f2f8d9e4c00c181d
- SHA512 a8f27c02536a7ad9ddac159e5bdafcab4a7105b2d31809d2a9104d0105f9c2df6c39992ec2b733d595a0382eec77ac9bd65047ca60512cde8b7b7ca1022fe1e6
- SSDEEP 12288:jSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:WvO2xJKRw2kOkx2LFRvcUV
- TLSH T111F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH