Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 09:40
Behavioral task
behavioral1
Sample
f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe
- Size 560KB
- Sample261002-lnaczstepf
- SHA256 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5
- MD5 089c902937e5807ee85dbe11e5a63698
- SHA1 c7050ba8bc4593f7e11ce50ab4126c1f3e779063
- SHA512 566d3e4867254bc309be22f7efb5b550344ef26eb241301707272e4bd29fd6d03461ef69e253e5e5fc7f290bc429119aa24ccd36e91ce37c1fa5f089e47375de
- SSDEEP 6144:z4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:zrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T159C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4236 87827f10 - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 333 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 419 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 472 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 502 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 182 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 3 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 5 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 40 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 149 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 320 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 362 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 363 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 95 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 235 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 281 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 473 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 236 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 41 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 94 114.114.114.114 4236 87827f10 Destination IP 150 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 181 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 319 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 418 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 503 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 284 223.5.5.5 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 332 114.114.114.114 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 87827f10 File created C:\Windows\SysWOW64\87827f10 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 87827f10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 87827f10 -
resource yara_rule behavioral2/memory/4156-0-0x0000000000380000-0x000000000040C000-memory.dmp upx behavioral2/files/0x000500000000053e-2.dat upx behavioral2/memory/4236-3-0x00000000002B0000-0x000000000033C000-memory.dmp upx behavioral2/memory/4156-18-0x0000000000380000-0x000000000040C000-memory.dmp upx behavioral2/memory/4236-19-0x00000000002B0000-0x000000000033C000-memory.dmp upx behavioral2/memory/4236-44-0x00000000002B0000-0x000000000033C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\488598 87827f10 File opened for modification C:\Windows\4726f8 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 87827f10 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 87827f10 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87827f10 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 87827f10 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 87827f10 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 87827f10 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 87827f10 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 87827f10 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 87827f10 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 87827f10 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 87827f10 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 87827f10 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4236 87827f10 4236 87827f10 4236 87827f10 4236 87827f10 4236 87827f10 4236 87827f10 4236 87827f10 4236 87827f10 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Token: SeTcbPrivilege 4156 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Token: SeDebugPrivilege 4236 87827f10 Token: SeTcbPrivilege 4236 87827f10
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe"C:\Users\Admin\AppData\Local\Temp\f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
C:\Windows\Syswow64\87827f10C:\Windows\Syswow64\87827f101⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\87827f10
- Size 560KB
- SHA256 d7964dfbb417da154c36c4accc41567fa84dc285cf97ae79a09ea2c0ab70f77d
- MD5 c1ed2047026bb444f8fd0dd88d5822c6
- SHA1 1a32e5867de564acbf9ec462afcc59f90ba6c5c4
- SHA512 145155c2777ee0c9f2abde6aa1bd5f69f7bac8bf029b5ec41254f03f8e2c67903ab110e8ec7457100973fcd6eaacad638d9573779bf8c10bea4ebdc80c6f9798
- SSDEEP 6144:34ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:3rNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T172C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH