Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 08:07
Behavioral task
behavioral1
Sample
bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe
- Size 560KB
- Sample261011-j1bepsysaz
- SHA256 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b
- MD5 4d425247d80a1efd3df99cda30fd3c45
- SHA1 d421b80d65d7fd1e57399f312ce32b33c4901664
- SHA512 04f19839e775a0d447e025d14195b5d264401e2b3d33f35d7ea097a33699a32745043031ef8ec9d6fef5ee1f310204740878d42e030f095b477ac0eab28be8f3
- SSDEEP 6144:i45aN1cnZ0ouTlJV/LbuUcCMBLCKqkFtirGcEOkCybEaQRXr9HNdvOa+y8K:iLNOnZezl3uUcCMBLCKksOkx2LIa+y
- TLSH T1BAC47D2AB6A0D076C4779574C4A257A6FFB1B42137204ACFA390875A1F237E2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2800 1ade2944 - Unexpected DNS network traffic destination 28 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 432 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 2 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 90 114.114.114.114 2800 1ade2944 Destination IP 177 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 230 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 490 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 520 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 580 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 581 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 1 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 37 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 176 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 285 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 349 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 435 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 489 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 521 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 35 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 91 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 145 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 231 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 314 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 348 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 378 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 379 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 144 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 284 114.114.114.114 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Destination IP 315 223.5.5.5 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\1ade2944 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1ade2944 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1ade2944 -
resource yara_rule behavioral2/memory/5376-0-0x0000000000770000-0x00000000007FC000-memory.dmp upx behavioral2/files/0x0009000000011370-2.dat upx behavioral2/memory/2800-3-0x0000000000580000-0x000000000060C000-memory.dmp upx behavioral2/memory/5376-20-0x0000000000770000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2800-21-0x0000000000580000-0x000000000060C000-memory.dmp upx behavioral2/memory/2800-46-0x0000000000580000-0x000000000060C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2fefe0 1ade2944 File opened for modification C:\Windows\5c0a00 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1ade2944 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1ade2944 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ade2944 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1ade2944 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1ade2944 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1ade2944 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1ade2944 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1ade2944 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1ade2944 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1ade2944 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1ade2944 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1ade2944 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2800 1ade2944 2800 1ade2944 2800 1ade2944 2800 1ade2944 2800 1ade2944 2800 1ade2944 2800 1ade2944 2800 1ade2944 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Token: SeTcbPrivilege 5376 bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe Token: SeDebugPrivilege 2800 1ade2944 Token: SeTcbPrivilege 2800 1ade2944
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe"C:\Users\Admin\AppData\Local\Temp\bc8200b91553efe7d57228dbcf3ba4b2b548093144b2579220b9479574c8c37b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
C:\Windows\Syswow64\1ade2944C:\Windows\Syswow64\1ade29441⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1ade2944
- Size 560KB
- SHA256 e020ebfb0be9eae12b21bc6db03d2f7f5a11879781398680a80ba7cbf67ae8c1
- MD5 8b65eb4b2d2ed577c615a6b6e76120aa
- SHA1 0ca01c6a2a0127dcd76bae10f3725293340274cd
- SHA512 ae7d30bb2e753de150939c132d2edde176277f1f97dba7b051fd7451fe0e510044e04ade05e243b34a0f301a357e5b5265c0661020a3b860180d41440a367dda
- SSDEEP 6144:145aN1cnZ0ouTlJV/LbuUcCMBLCKqkFtirGcEOkCybEaQRXr9HNdvOa+y8K:1LNOnZezl3uUcCMBLCKksOkx2LIa+y
- TLSH T177C47D2AB6A0D076C4779574C4A257A6FFB1B42137204ACFA390875A1F237E2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH