Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 04:34
Behavioral task
behavioral1
Sample
f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe
- Size 560KB
- Sample261011-e662cax12l
- SHA256 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6
- MD5 a3d7a8b79fdaef8d47e03fa3946b1637
- SHA1 ee58bb0ad40a5b4e0aa4865d6c1e9d06e8c29642
- SHA512 6ac63d567900abd4f8a48af61cab5eeca0cff137d83a789d1d7e3b42df32954d51128bed1a920c06dbd944ed946c3ddcd986640cc96149a1ddebf7557c465853
- SSDEEP 6144:0WVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:0kCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T112C47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3436 fd8b3ee5 - Unexpected DNS network traffic destination 25 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 148 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 180 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 235 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 289 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 318 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 408 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 468 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 498 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 5 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 320 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 352 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 499 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 181 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 234 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 287 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 321 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 353 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 3 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 39 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 40 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 93 114.114.114.114 3436 fd8b3ee5 Destination IP 95 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 149 223.5.5.5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 407 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Destination IP 467 114.114.114.114 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fd8b3ee5 File created C:\Windows\SysWOW64\fd8b3ee5 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fd8b3ee5 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fd8b3ee5 -
resource yara_rule behavioral2/memory/4324-0-0x00000000009C0000-0x0000000000A4C000-memory.dmp upx behavioral2/files/0x000800000001138c-2.dat upx behavioral2/memory/3436-3-0x00000000002F0000-0x000000000037C000-memory.dmp upx behavioral2/memory/4324-25-0x00000000009C0000-0x0000000000A4C000-memory.dmp upx behavioral2/memory/3436-26-0x00000000002F0000-0x000000000037C000-memory.dmp upx behavioral2/memory/3436-53-0x00000000002F0000-0x000000000037C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3ad358 fd8b3ee5 File opened for modification C:\Windows\4a0748 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fd8b3ee5 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fd8b3ee5 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd8b3ee5 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fd8b3ee5 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fd8b3ee5 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fd8b3ee5 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fd8b3ee5 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fd8b3ee5 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fd8b3ee5 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fd8b3ee5 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fd8b3ee5 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fd8b3ee5 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 3436 fd8b3ee5 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Token: SeTcbPrivilege 4324 f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe Token: SeDebugPrivilege 3436 fd8b3ee5 Token: SeTcbPrivilege 3436 fd8b3ee5
Processes
-
C:\Users\Admin\AppData\Local\Temp\f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe"C:\Users\Admin\AppData\Local\Temp\f04a0c3bbb5ef5af42d130031db1e4cd87bc65d750ed4686d598237dd44a2ac6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
C:\Windows\Syswow64\fd8b3ee5C:\Windows\Syswow64\fd8b3ee51⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\3ad358
- Size 906B
- SHA256 e978c805ee05d6d9181fc598a421db49d6ed3476665c4542f08b9858ffa9a5b3
- MD5 673afed63cd48c81b57832c1c0b4c994
- SHA1 2486d312bf27d044ed1df7549ce298203d9eeac1
- SHA512 9d4db54a4e6ce12e8b9e39e884560cb7607d050a41b1e5198a5a969ff5ef3179046615b925c1fa015bb88b3c204a53f4c5a11d76704a2890e3e1cf86b51bb201
- TLSH T182113632DC54F7F27CBA426436E2ACCC76213A8FC7C651334A82E4422263A5CC4E249F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\fd8b3ee5
- Size 560KB
- SHA256 190d2d03fe311f208cefc8f9320f034788fe03b05d947dd3b3a863268a51e688
- MD5 11d01b5d538b67bbc0d2b63109ad1a61
- SHA1 4ea7ac97f5448ba4e194e8107fde2f82456392b2
- SHA512 ae00c2811b2eed455890d48b35f8f7f085979244994a2407ae12f4ffd5c885fe23d62654b1ef56852a3377b372ff3b3bec264a3ee20c9e03997e65e89b7c6d26
- SSDEEP 6144:VWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:VkCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T138C47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH