Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe
- Size 419KB
- Sample261002-hraw5sbe87
- SHA256 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6
- MD5 8c58e0e1c39a06cff581e24ca06cde50
- SHA1 f078a629eaf055a48d2e05e116a600ed7fd5bc6b
- SHA512 bbed4ba368d8b76257d591eff0316b8c7eda7b71fc005c75a477c91b50d486ab409a107f6e8928855e62f7287f2f8e4949b192a9c99dc7777b116f907d18e008
- SSDEEP 6144:katygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:katG+S9+kaTDHrOkx2LIa
- TLSH T1BC948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1064 8ae36cf8 - Unexpected DNS network traffic destination 19 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 445 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 1 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 96 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 235 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 305 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 390 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 94 114.114.114.114 1064 8ae36cf8 Destination IP 181 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 289 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 40 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 304 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 391 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 444 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 4 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 149 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 150 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 236 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 290 223.5.5.5 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Destination IP 336 114.114.114.114 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8ae36cf8 File created C:\Windows\SysWOW64\8ae36cf8 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8ae36cf8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8ae36cf8 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\123750 8ae36cf8 File opened for modification C:\Windows\49afa0 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 8ae36cf8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 8ae36cf8 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ae36cf8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8ae36cf8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8ae36cf8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8ae36cf8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8ae36cf8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8ae36cf8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8ae36cf8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8ae36cf8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8ae36cf8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8ae36cf8 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1064 8ae36cf8 1064 8ae36cf8 1064 8ae36cf8 1064 8ae36cf8 1064 8ae36cf8 1064 8ae36cf8 1064 8ae36cf8 1064 8ae36cf8 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Token: SeTcbPrivilege 4304 26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe Token: SeDebugPrivilege 1064 8ae36cf8 Token: SeTcbPrivilege 1064 8ae36cf8
Processes
-
C:\Users\Admin\AppData\Local\Temp\26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe"C:\Users\Admin\AppData\Local\Temp\26fd9f2a1bc13e4602074f317e9616b5e6e0bfa9a149bb086b85ce50c87c86a6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\Syswow64\8ae36cf8C:\Windows\Syswow64\8ae36cf81⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\8ae36cf8
- Size 419KB
- SHA256 b8faf21f57814dbdc9351f64b60cea53296274bf2e7bf895f106d75b22802771
- MD5 5079081b7896827a015b9ee6e202c305
- SHA1 e0e793f5ede0d15f2a6aded36605d985fcdf4d23
- SHA512 7b2672e6ed859aa433b23697d57b9b12f8444f4f0256a86363605c51126aad4412e9457f6370546795ff99d99645c609432d028373565505e6cd49eafe8fc369
- SSDEEP 6144:2atygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:2atG+S9+kaTDHrOkx2LIa
- TLSH T1D8948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
- MD5 SHA1 SHA512 SSDEEP TLSH