Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe
- Size 487KB
- Sample261011-e8qgdady5p
- SHA256 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b
- MD5 d968fe30bfbcded9345a47474d3f1d2d
- SHA1 934a589c6d08a447f1d556a796fd888f69808f02
- SHA512 25a641f617410491c203e7f5bc098b7756ae27df5e0e109509dca78c89b0ffc3c8305b8779f1f9cdad82963ea72e0de6ccdd2712c8c139e89e2b3ad152c556ab
- SSDEEP 6144:acTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KU5R2:aSvO2x9mONvKRILSFnOkx2LIaxya5g
- TLSH T16EB45B26B6908036C0B78675C5F64BAAFAB5BC21631186CFA380365A1F737D2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4588 98835815 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 393 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 447 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 1 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 236 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 289 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 394 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 181 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 290 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 340 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 448 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 40 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 94 114.114.114.114 4588 98835815 Destination IP 96 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 149 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 150 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 307 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 339 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 4 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 41 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 182 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 235 114.114.114.114 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Destination IP 308 223.5.5.5 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 98835815 File created C:\Windows\SysWOW64\98835815 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 98835815 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 98835815 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4e8c58 98835815 File opened for modification C:\Windows\658ed8 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 98835815 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 98835815 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98835815 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 98835815 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 98835815 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 98835815 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 98835815 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 98835815 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 98835815 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 98835815 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 98835815 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 98835815 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4588 98835815 4588 98835815 4588 98835815 4588 98835815 4588 98835815 4588 98835815 4588 98835815 4588 98835815 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Token: SeTcbPrivilege 5932 9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe Token: SeDebugPrivilege 4588 98835815 Token: SeTcbPrivilege 4588 98835815
Processes
-
C:\Users\Admin\AppData\Local\Temp\9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe"C:\Users\Admin\AppData\Local\Temp\9be2e3b576a33251293f495abc675e484ecba9a18a7ffa738de2779ffab1878b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932
-
C:\Windows\Syswow64\98835815C:\Windows\Syswow64\988358151⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\98835815
- Size 487KB
- SHA256 6593aee18144160b361f81fd7399f6e98d2e039546c5f29b346f73e1f144e5e5
- MD5 9b3a298a3458b3c465716363060d45cc
- SHA1 f52d1a398c1c27b490560bfe5ace28a34828b2cc
- SHA512 8299dd0a059bbfbe2bcf0df07650ef61121f768c2d38b543556afdfe9be54984ad3e8c97f7fd3b4e26f6d8b36bb32daa3dd0e11d064c424c7bee72263dc2608b
- SSDEEP 6144:vcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KU5R2:vSvO2x9mONvKRILSFnOkx2LIaxya5g
- TLSH T11DB45B26B6908036C0B78675C5F64BAAFAB5BC21631186CFA380365A1F737D2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH