Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe
- Size 1.6MB
- Sample261002-hmrn4atfkd
- SHA256 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68
- MD5 b133ef103252d3974b169b05774dfcec
- SHA1 b0b087f238c64ff0b5d53e7c1bc9d499deec9852
- SHA512 5481c4acd71eb1ddfb31c614e04b84e7c13a9f8fb8dab26604e4e5f6f534648c41f24521687fe243fbbd39ad0d5714461c8e6a6aedd454369b52fccb51b230c7
- SSDEEP 24576:LvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAKjHG:LHHKO29Qm5QZuTtS0rQMYOQ+q8CEKTGJ
- TLSH T174759E21B351C036D4AB01758AB98BAEA578BD710B2551C7B3C47B7E5FB12D2AA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1992 3361a816 - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 303 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 398 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 497 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 557 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 195 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 196 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 229 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 363 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 364 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 399 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 405 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 558 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 7 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 436 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 589 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 59 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 124 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 304 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 406 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 437 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 498 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 588 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 3 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 58 114.114.114.114 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Destination IP 123 114.114.114.114 1992 3361a816 Destination IP 234 223.5.5.5 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3361a816 File created C:\Windows\SysWOW64\3361a816 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3361a816 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3361a816 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\221a90 3361a816 File opened for modification C:\Windows\352440 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 3361a816 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 3361a816 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3361a816 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3361a816 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3361a816 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3361a816 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3361a816 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3361a816 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3361a816 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3361a816 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3361a816 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3361a816 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 1992 3361a816 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Token: SeTcbPrivilege 3104 01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe Token: SeDebugPrivilege 1992 3361a816 Token: SeTcbPrivilege 1992 3361a816
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe"C:\Users\Admin\AppData\Local\Temp\01ed49282236ec2ce93fc3c04e6bb11954ba6f1b590bf26628ecc9052a57ae68.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
C:\Windows\Syswow64\3361a816C:\Windows\Syswow64\3361a8161⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3361a816
- Size 1.6MB
- SHA256 4096f19312e9cbaf717b8035488ef2b6ba7297ee821aa6c9305d75b564b92971
- MD5 fb21bee59bfd71e065a3500bb46fbf24
- SHA1 30cff3a6a3bf59acb3a4fb195457fbde803bbaed
- SHA512 42351c9b96932e2cb8d7a98cbf780ed2542b6607ee870e6937e0d620de34c37cb5368290b94a88693dbf66079abb9a5e37d4199dcf86fec3edee3a539e97086e
- SSDEEP 24576:QvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAKjHG:QHHKO29Qm5QZuTtS0rQMYOQ+q8CEKTGJ
- TLSH T1DD759E21B351C036D4AB01758AB98BAEA578BD710B2551C7B3C47B7E5FB12D2AA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH