Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 06:51
Behavioral task
behavioral1
Sample
5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe
- Size 761KB
- Sample261002-hmrn4atfkc
- SHA256 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9
- MD5 2126a84ed5ae6d75a660dd533089c168
- SHA1 8d894fea4a828a7c46dd18fd33d0f152ead18966
- SHA512 1489fdde0f8164023f96644375382fc56c3ead17e9f5f152aa6d5f6e443e56f09ea3d6b64c5b06fd3aad93c0a03d53d51a1f881ce975fff4e39d0fc59eb38a8f
- SSDEEP 12288:4SvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:TvO2xJKRw2kOkxSkW298B
- TLSH T16AF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5248 970d1d96 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 453 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 182 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 284 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 313 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 452 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 1 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 4 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 41 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 95 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 181 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 235 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 312 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 345 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 40 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 149 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 150 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 281 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 344 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 399 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 94 114.114.114.114 5248 970d1d96 Destination IP 236 223.5.5.5 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Destination IP 398 114.114.114.114 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 970d1d96 File created C:\Windows\SysWOW64\970d1d96 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 970d1d96 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 970d1d96 -
resource yara_rule behavioral2/memory/2816-0-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral2/files/0x0014000000016a78-2.dat upx behavioral2/memory/5248-3-0x0000000000AD0000-0x0000000000B5C000-memory.dmp upx behavioral2/memory/2816-18-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral2/memory/5248-19-0x0000000000AD0000-0x0000000000B5C000-memory.dmp upx behavioral2/memory/5248-42-0x0000000000AD0000-0x0000000000B5C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\303600 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe File opened for modification C:\Windows\59d900 970d1d96 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 970d1d96 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 970d1d96 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 970d1d96 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 970d1d96 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 970d1d96 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 970d1d96 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 970d1d96 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 970d1d96 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 970d1d96 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 970d1d96 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 970d1d96 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 970d1d96 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5248 970d1d96 5248 970d1d96 5248 970d1d96 5248 970d1d96 5248 970d1d96 5248 970d1d96 5248 970d1d96 5248 970d1d96 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Token: SeTcbPrivilege 2816 5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe Token: SeDebugPrivilege 5248 970d1d96 Token: SeTcbPrivilege 5248 970d1d96
Processes
-
C:\Users\Admin\AppData\Local\Temp\5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe"C:\Users\Admin\AppData\Local\Temp\5304ad3b834eaa92251e52dab80d7d872ba8ab067ed489f4ce38d97f95ea02b9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
C:\Windows\Syswow64\970d1d96C:\Windows\Syswow64\970d1d961⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\970d1d96
- Size 761KB
- SHA256 6dd86ccde068d6f5fcabe41bdd9c0a1d5afc6dba7b6ffbe1e332e916fc258508
- MD5 875864bc4c9a9d191b7f34a3ffe70f28
- SHA1 1c6fd7bd88649945be6da6a771671b8cd93dca14
- SHA512 f4834a9bc79e2b73d127eed8fbd216cd5e173fb230935eec065fc6ad8c1beb13401be6b469343339c158e6f1076e3039a2e260c4c38053ec619fdf60601f6a11
- SSDEEP 12288:YSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:zvO2xJKRw2kOkxSkW298B
- TLSH T156F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH