Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 08:13
Behavioral task
behavioral1
Sample
65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe
- Size 560KB
- Sample261002-j4rabsde63
- SHA256 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90
- MD5 3ce41ee6842f0f475b0bca424d576ee2
- SHA1 3efc8bf39f499bce8eeeaae04593b68cf74ab976
- SHA512 aa8ff5f4b7ad19e20004bb49ac21397c48b5f8147189ccc9895c9234a86c71e61fea4af7b2fbd1eb51678f249eab012a37f118525055e0d6693ff64edeaacb7c
- SSDEEP 12288:r3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:ZVOL4/gPXKCOkx2LFR
- TLSH T14BC46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3804 da0615dc - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 149 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 234 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 303 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 335 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 390 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 1 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 2 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 148 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 288 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 304 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 39 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 40 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 93 114.114.114.114 3804 da0615dc Destination IP 180 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 181 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 289 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 336 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 95 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 235 223.5.5.5 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Destination IP 389 114.114.114.114 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 da0615dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 da0615dc File created C:\Windows\SysWOW64\da0615dc 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE da0615dc -
resource yara_rule behavioral2/memory/4864-0-0x0000000000AC0000-0x0000000000B4C000-memory.dmp upx behavioral2/files/0x000d000000019cb7-2.dat upx behavioral2/memory/3804-3-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/4864-18-0x0000000000AC0000-0x0000000000B4C000-memory.dmp upx behavioral2/memory/3804-19-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/3804-42-0x0000000000390000-0x000000000041C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\412038 da0615dc File opened for modification C:\Windows\534600 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain da0615dc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname da0615dc - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da0615dc - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix da0615dc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" da0615dc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" da0615dc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" da0615dc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" da0615dc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ da0615dc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" da0615dc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" da0615dc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing da0615dc - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3804 da0615dc 3804 da0615dc 3804 da0615dc 3804 da0615dc 3804 da0615dc 3804 da0615dc 3804 da0615dc 3804 da0615dc 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Token: SeTcbPrivilege 4864 65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe Token: SeDebugPrivilege 3804 da0615dc Token: SeTcbPrivilege 3804 da0615dc
Processes
-
C:\Users\Admin\AppData\Local\Temp\65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe"C:\Users\Admin\AppData\Local\Temp\65437c9cbe6908871b6046aecd100fc70eb5b84fd7073e583a9c0a330b763d90.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
C:\Windows\Syswow64\da0615dcC:\Windows\Syswow64\da0615dc1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\da0615dc
- Size 560KB
- SHA256 9a257e2a7f4ea20c95c47be11824598f1c400ed73d90555a10e3e4c29996eaad
- MD5 f0df5558ed1fd693a46fcd734d5fb0b7
- SHA1 6b3378ffeb0ff765fc28f91fcc05923926fd36be
- SHA512 16472a49a1080871aa8b0584716dfcb1398ac14aaade9c2e41651cae3306a4142159c7e24699a5bfa850eb44e87bb4508b6fd66d3738387bb940ec9c35caf804
- SSDEEP 12288:x3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:jVOL4/gPXKCOkx2LFR
- TLSH T1C2C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH