Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 07:32
Behavioral task
behavioral1
Sample
6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe
- Size 1.1MB
- Sample261002-jdf2nsw16p
- SHA256 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4
- MD5 ac207f2d523e1e3d1bdf103e003b1ad3
- SHA1 f3a143dfe870bbc56fbaf22c20b21dd8de5ab302
- SHA512 27ccef055f194cd7e1271e088312188c0fbb6d3f1cabaeecc2690ff7751aa7533568ef83e738f121b3b140f6acf3043ed90a0bae00df3bdc21b611721082b5b6
- SSDEEP 12288:XSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:ivO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T196357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4956 5ea5af0c - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 131 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 177 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 231 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 372 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 35 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 91 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 176 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 287 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 318 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 371 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 2 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 119 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 1 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 90 114.114.114.114 4956 5ea5af0c Destination IP 230 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 288 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 317 114.114.114.114 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Destination IP 36 223.5.5.5 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5ea5af0c File created C:\Windows\SysWOW64\5ea5af0c 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5ea5af0c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5ea5af0c -
resource yara_rule behavioral2/memory/2984-0-0x0000000000AA0000-0x0000000000B2C000-memory.dmp upx behavioral2/files/0x003b00000001166b-2.dat upx behavioral2/memory/4956-3-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/2984-20-0x0000000000AA0000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/4956-21-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/4956-42-0x0000000000390000-0x000000000041C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\331650 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe File opened for modification C:\Windows\54d938 5ea5af0c - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5ea5af0c Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5ea5af0c Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ea5af0c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5ea5af0c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5ea5af0c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5ea5af0c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5ea5af0c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5ea5af0c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5ea5af0c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5ea5af0c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5ea5af0c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5ea5af0c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4956 5ea5af0c 4956 5ea5af0c 4956 5ea5af0c 4956 5ea5af0c 4956 5ea5af0c 4956 5ea5af0c 4956 5ea5af0c 4956 5ea5af0c 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Token: SeTcbPrivilege 2984 6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe Token: SeDebugPrivilege 4956 5ea5af0c Token: SeTcbPrivilege 4956 5ea5af0c
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe"C:\Users\Admin\AppData\Local\Temp\6e94bd3843476810f853a28c28c6fef195aa6f6fd3a1f8f8840e001293d0cca4.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
C:\Windows\Syswow64\5ea5af0cC:\Windows\Syswow64\5ea5af0c1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5ea5af0c
- Size 1.1MB
- SHA256 3fed8cd3401a93801d858e0d9829201fb7d87c1857dee30cda8ab36e1a88b3a4
- MD5 840eaf95441254e05e3055dae0992d70
- SHA1 09843bf5126a57c2cafa0eff19e3991b53cbc6c2
- SHA512 9c761c2b4a5eb5316212869dd26d4c6a38ba24e4534c667b745af0af0f6c9260638e557e7a9d58011e8499e13492f1e8e2c67adb5adf8c6c4b25c3b931f708d0
- SSDEEP 12288:1SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidzN/VTg:0vO2xJKRw2kOkx2LFRvcU6UQOJdM
- TLSH T124357C31A681C036D5B34571C6FA4BBBA9747D25131165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH