Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 09:37
Behavioral task
behavioral1
Sample
4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe
- Size 766KB
- Sample261002-llymsstdnh
- SHA256 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8
- MD5 705160ccfa09c4a4c1485ffcbdd3027b
- SHA1 7e83acdeaaba706956ecc38a8e0891f6d1433771
- SHA512 0bc6ac037e310b7e7c5758d8c96ce4ba174e752675b2f115be31363c885c99d4f96887087b43435fdd2eefc22cafc5649460dba8a5c86050c9ccdb27a2a1638f
- SSDEEP 12288:6SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:hvO2xJKRw2kOkx2LFRvcUV
- TLSH T192F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4640 fceb1170 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 399 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 3 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 58 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 122 114.114.114.114 4640 fceb1170 Destination IP 137 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 219 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 367 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 398 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 460 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 125 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 222 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 299 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 300 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 459 114.114.114.114 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 139 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 4 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 60 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 368 223.5.5.5 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fceb1170 File created C:\Windows\SysWOW64\fceb1170 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fceb1170 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fceb1170 -
resource yara_rule behavioral1/memory/2776-0-0x0000000000E30000-0x0000000000EBC000-memory.dmp upx behavioral1/files/0x000a0000000243b8-2.dat upx behavioral1/memory/4640-3-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral1/memory/2776-18-0x0000000000E30000-0x0000000000EBC000-memory.dmp upx behavioral1/memory/4640-19-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral1/memory/4640-38-0x0000000000080000-0x000000000010C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4f7040 fceb1170 File opened for modification C:\Windows\2f86b0 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fceb1170 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fceb1170 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fceb1170 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fceb1170 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fceb1170 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fceb1170 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fceb1170 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fceb1170 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fceb1170 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fceb1170 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fceb1170 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fceb1170 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 4640 fceb1170 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Token: SeTcbPrivilege 2776 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Token: SeDebugPrivilege 4640 fceb1170 Token: SeTcbPrivilege 4640 fceb1170
Processes
-
C:\Users\Admin\AppData\Local\Temp\4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe"C:\Users\Admin\AppData\Local\Temp\4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Windows\Syswow64\fceb1170C:\Windows\Syswow64\fceb11701⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fceb1170
- Size 766KB
- SHA256 a39b3db682b84fcfd23b5f17575fa5bd6f48d170f6731d8081b04c66f15a353e
- MD5 12278fbdb172e977c98693baf5ca487c
- SHA1 0533e3cabc649ae23893efa7d6245ce42cf55626
- SHA512 23af354908c00848719d688d50b2b5198d7b64b1ef856b9fd183083e3c03d6ccf24a41f332a28af7a6b12667df5dadffa5a8d712bfbc3f814646ac5a4c8bcb5a
- SSDEEP 12288:qSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:xvO2xJKRw2kOkx2LFRvcUV
- TLSH T1A0F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH