Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 10:07
Behavioral task
behavioral1
Sample
45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe
- Size 560KB
- Sample261002-l5qrasfd82
- SHA256 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b
- MD5 9c9a6a2d2b79f47ba6768bd15bd2d061
- SHA1 42dde204acd878b60536b9b23e1a7b0b79a5ce85
- SHA512 6fb7416cdc69a6ca0051a7597918fe5e5800cabb7b8db20c264f994f053f45a9a9537e3f4b86a3f5c20be4eac5235f2f866ea4a23bf528a8f70ccc393013d156
- SSDEEP 6144:MWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:MkCO2zVPX7vf1LKlIsOkxHy
- TLSH T1EAC47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D40B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3768 24605413 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 183 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 293 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 324 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 41 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 127 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 294 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 377 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 378 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 4 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 95 114.114.114.114 3768 24605413 Destination IP 129 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 182 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 236 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 40 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 96 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 237 223.5.5.5 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Destination IP 323 114.114.114.114 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 24605413 File created C:\Windows\SysWOW64\24605413 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 24605413 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 24605413 -
resource yara_rule behavioral2/memory/3084-0-0x00000000007F0000-0x000000000087C000-memory.dmp upx behavioral2/files/0x00170000000115bd-2.dat upx behavioral2/memory/3768-3-0x00000000008D0000-0x000000000095C000-memory.dmp upx behavioral2/memory/3084-16-0x00000000007F0000-0x000000000087C000-memory.dmp upx behavioral2/memory/3768-19-0x00000000008D0000-0x000000000095C000-memory.dmp upx behavioral2/memory/3768-40-0x00000000008D0000-0x000000000095C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\34cc98 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe File opened for modification C:\Windows\408270 24605413 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 24605413 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 24605413 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24605413 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 24605413 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 24605413 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 24605413 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 24605413 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 24605413 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 24605413 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 24605413 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 24605413 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 24605413 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3768 24605413 3768 24605413 3768 24605413 3768 24605413 3768 24605413 3768 24605413 3768 24605413 3768 24605413 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Token: SeTcbPrivilege 3084 45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe Token: SeDebugPrivilege 3768 24605413 Token: SeTcbPrivilege 3768 24605413
Processes
-
C:\Users\Admin\AppData\Local\Temp\45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe"C:\Users\Admin\AppData\Local\Temp\45d95d32d2b307d8cd9b6ede38d24e440f33a2f2c7284c5dca5344631ff84e6b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
C:\Windows\Syswow64\24605413C:\Windows\Syswow64\246054131⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\24605413
- Size 560KB
- SHA256 3e492664adfbb431a13e02ae53d8a4d6903f55deb4ab1880d7e2995804238a37
- MD5 4bd8aa164076190d2f06a1d3bf2c1b2a
- SHA1 e873abfe6e556f9eabb77f923d5387f0fc10e01f
- SHA512 92e392562fe11849201aceb6fa8bb2dbb03251825fecfdcac6f0c417ea06c10870efb473fe5bace08c2c494ae34e8cb055ab7a6d274c203e095fe0424adc8886
- SSDEEP 6144:yWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:ykCO2zVPX7vf1LKlIsOkxHy
- TLSH T1ECC47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D00B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH