Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 19:34
Behavioral task
behavioral1
Sample
1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe
- Size 560KB
- Sample261002-x95a2age92
- SHA256 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad
- MD5 cb0b08e883b01b36e2fe54a6cad88e4c
- SHA1 1a43d46d84e068a3fa5a16900282e425ce377cbb
- SHA512 ecec1ec4a421979c65a52df86385a5e8eff989acf3323d5baaadad2b7368261ff45463e6d40a7a0d2005c3f61fc9d331ec211aa5e9816d3ac8afe8cda2647349
- SSDEEP 12288:EftONCx61vvGEYQFNEhyQU/lLi2IsOkxHy:GtONCTU/lmaOkxS
- TLSH T19AC48E29B6D0C076C4B79574C4A186BAFAB17432372089CFA39407571F637D2BA3974E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4476 adcc1eec - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 40 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 182 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 235 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 236 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 288 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 313 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 345 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 41 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 181 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 285 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 399 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 6 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 95 114.114.114.114 4476 adcc1eec Destination IP 96 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 149 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 312 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 398 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 452 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 150 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 344 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 453 223.5.5.5 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Destination IP 4 114.114.114.114 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 adcc1eec File created C:\Windows\SysWOW64\adcc1eec 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 adcc1eec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content adcc1eec -
resource yara_rule behavioral2/memory/6036-0-0x00000000003C0000-0x000000000044C000-memory.dmp upx behavioral2/memory/4476-3-0x00000000009F0000-0x0000000000A7C000-memory.dmp upx behavioral2/files/0x000600000001b87d-4.dat upx behavioral2/memory/6036-18-0x00000000003C0000-0x000000000044C000-memory.dmp upx behavioral2/memory/4476-19-0x00000000009F0000-0x0000000000A7C000-memory.dmp upx behavioral2/memory/4476-42-0x00000000009F0000-0x0000000000A7C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4ca178 adcc1eec File opened for modification C:\Windows\6756a8 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname adcc1eec Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain adcc1eec Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adcc1eec - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix adcc1eec Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" adcc1eec Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ adcc1eec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" adcc1eec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" adcc1eec Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing adcc1eec Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" adcc1eec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" adcc1eec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" adcc1eec - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4476 adcc1eec 4476 adcc1eec 4476 adcc1eec 4476 adcc1eec 4476 adcc1eec 4476 adcc1eec 4476 adcc1eec 4476 adcc1eec 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Token: SeTcbPrivilege 6036 1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe Token: SeDebugPrivilege 4476 adcc1eec Token: SeTcbPrivilege 4476 adcc1eec
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe"C:\Users\Admin\AppData\Local\Temp\1b656b11bb3dc4937c580be7ae472075cde2e4d3e95f9811cb4afbeb60e629ad.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036
-
C:\Windows\Syswow64\adcc1eecC:\Windows\Syswow64\adcc1eec1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\adcc1eec
- Size 560KB
- SHA256 6b5ec0be9d50d37fdb04ef36f5b2a7c43669a6a4935e084c6e8c2ff629b6bfd5
- MD5 41a221e9f43c8153cb574d0e8e9451f1
- SHA1 f5a7a44fe98670e2d76fc7e9bd52637125ef57ee
- SHA512 9951731d5bc590742554d2c1ef9d2dde87d1ecaccf8fa24ff91cc6857d34f15b496b11d35fd62f5b00e511299494a3d831c139cbfb236d3760db1da4b801ace1
- SSDEEP 12288:QftONCx61vvGEYQFNEhyQU/lLi2IsOkxHy:ytONCTU/lmaOkxS
- TLSH T112C48E29B6E0C076C4B79574C4A186BAFAB17432372089CFA39407571F637D2BA3974E
- MD5 SHA1 SHA512 SSDEEP TLSH