Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 09:37
Behavioral task
behavioral1
Sample
4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe
- Size 766KB
- Sample261002-llymsstdnh
- SHA256 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8
- MD5 705160ccfa09c4a4c1485ffcbdd3027b
- SHA1 7e83acdeaaba706956ecc38a8e0891f6d1433771
- SHA512 0bc6ac037e310b7e7c5758d8c96ce4ba174e752675b2f115be31363c885c99d4f96887087b43435fdd2eefc22cafc5649460dba8a5c86050c9ccdb27a2a1638f
- SSDEEP 12288:6SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:hvO2xJKRw2kOkx2LFRvcUV
- TLSH T192F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1220 fa59d591 - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 150 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 182 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 332 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 40 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 235 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 288 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 299 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 300 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 331 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 385 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 2 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 236 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 290 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 1 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 149 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 181 114.114.114.114 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 386 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 41 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Destination IP 95 114.114.114.114 1220 fa59d591 Destination IP 96 223.5.5.5 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fa59d591 File created C:\Windows\SysWOW64\fa59d591 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fa59d591 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fa59d591 -
resource yara_rule behavioral2/memory/4184-0-0x0000000000FF0000-0x000000000107C000-memory.dmp upx behavioral2/files/0x000c00000001b869-2.dat upx behavioral2/memory/1220-3-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx behavioral2/memory/4184-18-0x0000000000FF0000-0x000000000107C000-memory.dmp upx behavioral2/memory/1220-19-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx behavioral2/memory/1220-42-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\14e308 fa59d591 File opened for modification C:\Windows\47a1b0 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fa59d591 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fa59d591 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa59d591 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fa59d591 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fa59d591 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fa59d591 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fa59d591 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fa59d591 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fa59d591 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fa59d591 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fa59d591 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fa59d591 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1220 fa59d591 1220 fa59d591 1220 fa59d591 1220 fa59d591 1220 fa59d591 1220 fa59d591 1220 fa59d591 1220 fa59d591 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Token: SeTcbPrivilege 4184 4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe Token: SeDebugPrivilege 1220 fa59d591 Token: SeTcbPrivilege 1220 fa59d591
Processes
-
C:\Users\Admin\AppData\Local\Temp\4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe"C:\Users\Admin\AppData\Local\Temp\4517780eff9241ebace2897b1b318d9c3f1b51cb5908e012a5ed9c693d94c9a8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
C:\Windows\Syswow64\fa59d591C:\Windows\Syswow64\fa59d5911⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fa59d591
- Size 766KB
- SHA256 01654102c5bba12b3bc8f821480702672c68ae0c601ae4647086fd8c3db9dabf
- MD5 fbcfd151bfc1e2e64b443c0434d02308
- SHA1 122cbb5f18b0f8078fcb26bb993b5311a4167fe6
- SHA512 9f945a8840fc1035e4e10a29056979079fd9136a18c4b2ca914c48871731fafaee57379cbe4b0dc1ffe4b1543c75d367957059026a538612d2648883122473ac
- SSDEEP 12288:bSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:uvO2xJKRw2kOkx2LFRvcUV
- TLSH T177F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH