Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 19:40
Behavioral task
behavioral1
Sample
c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe
- Size 560KB
- Sample261006-ydv8xsf14q
- SHA256 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54
- MD5 9a3224a1c1bd174e749eef4e79bf89c3
- SHA1 42e897bb5ef131ff8484591a7e4cc05408cc54b6
- SHA512 26292087a2f79874dacea02c83112ff1cf0024ea5cc588305d5910cde94561900663d7cb869b9390d8d765dde5af7dc2098ba586826074d22deb6c7c06cbba83
- SSDEEP 6144:IUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:IYsVOdhElvkCgvDLe4usOkxHy
- TLSH T15EC48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3244 5d34deb8 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 457 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 182 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 235 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 236 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 347 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 403 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 404 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 96 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 181 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 284 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 1 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 4 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 149 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 317 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 318 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 458 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 40 114.114.114.114 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 41 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 94 114.114.114.114 3244 5d34deb8 Destination IP 150 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 286 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Destination IP 349 223.5.5.5 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5d34deb8 File created C:\Windows\SysWOW64\5d34deb8 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5d34deb8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5d34deb8 -
resource yara_rule behavioral2/memory/1140-0-0x0000000000DB0000-0x0000000000E3C000-memory.dmp upx behavioral2/files/0x001b00000000696b-2.dat upx behavioral2/memory/3244-3-0x00000000008E0000-0x000000000096C000-memory.dmp upx behavioral2/memory/1140-18-0x0000000000DB0000-0x0000000000E3C000-memory.dmp upx behavioral2/memory/3244-19-0x00000000008E0000-0x000000000096C000-memory.dmp upx behavioral2/memory/3244-42-0x00000000008E0000-0x000000000096C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\138468 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe File opened for modification C:\Windows\3789d8 5d34deb8 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5d34deb8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5d34deb8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d34deb8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5d34deb8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5d34deb8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5d34deb8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5d34deb8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5d34deb8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5d34deb8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5d34deb8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5d34deb8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5d34deb8 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3244 5d34deb8 3244 5d34deb8 3244 5d34deb8 3244 5d34deb8 3244 5d34deb8 3244 5d34deb8 3244 5d34deb8 3244 5d34deb8 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Token: SeTcbPrivilege 1140 c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe Token: SeDebugPrivilege 3244 5d34deb8 Token: SeTcbPrivilege 3244 5d34deb8
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe"C:\Users\Admin\AppData\Local\Temp\c3132bf5c501bb94807f453eb73a619c75da8f918c2b867081b8cbd897d03e54.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
C:\Windows\Syswow64\5d34deb8C:\Windows\Syswow64\5d34deb81⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5d34deb8
- Size 560KB
- SHA256 56f2efed7707488608303957bb866796b4c1df1ecbb9b797a7053d7ad95b357f
- MD5 2436a89f9ceb894a4e9d523c3a1f7a56
- SHA1 24748b0ec4f9db610e742847f32a35b438156db7
- SHA512 061064f0a30983b76f1ac9894e57dc4fe7a1644086f58e9f39894107bcf78e10d0cc828fea8db893da89becafe18d1db3167d732e9e031fa100aa49ed50cdee7
- SSDEEP 6144:xUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:xYsVOdhElvkCgvDLe4usOkxHy
- TLSH T146C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH