Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 18:41
Behavioral task
behavioral1
Sample
0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe
- Size 638KB
- Sample261012-xb4lvav13l
- SHA256 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe
- MD5 c399f8775bd9433fe1e7aeea9189a1a1
- SHA1 26ca8581150e2b738b98795d982f5e015104f01d
- SHA512 8474e8100d6d72208cdac1eeb5f4e86b315210418b88742ef3932f836444c0ddf90300c69031b52d69e0703558c34b42380463ff0c1e5f17a262a3dcf0990cad
- SSDEEP 6144:VcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8KU5R2:VSvO2x9mONvKRwLSFtsOkx2LIa+ya5g
- TLSH T111D46B26B6908037C0B74675C5B64BAAFAB5BC21631186CFA380761A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2012 7f0e6956 - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 314 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 354 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 409 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 466 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 497 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 35 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 89 114.114.114.114 2012 7f0e6956 Destination IP 90 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 144 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 176 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 465 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 1 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 36 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 145 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 230 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 231 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 285 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 410 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 496 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 177 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 283 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 315 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 323 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 324 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 353 114.114.114.114 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Destination IP 2 223.5.5.5 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 7f0e6956 File created C:\Windows\SysWOW64\7f0e6956 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7f0e6956 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7f0e6956 -
resource yara_rule behavioral2/memory/3124-0-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral2/files/0x001100000001b8aa-2.dat upx behavioral2/memory/2012-3-0x0000000000800000-0x000000000088C000-memory.dmp upx behavioral2/memory/3124-20-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral2/memory/2012-21-0x0000000000800000-0x000000000088C000-memory.dmp upx behavioral2/memory/2012-46-0x0000000000800000-0x000000000088C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\227238 7f0e6956 File opened for modification C:\Windows\357be8 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 7f0e6956 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 7f0e6956 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7f0e6956 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 7f0e6956 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 7f0e6956 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 7f0e6956 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 7f0e6956 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 7f0e6956 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 7f0e6956 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 7f0e6956 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 7f0e6956 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 7f0e6956 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2012 7f0e6956 2012 7f0e6956 2012 7f0e6956 2012 7f0e6956 2012 7f0e6956 2012 7f0e6956 2012 7f0e6956 2012 7f0e6956 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Token: SeTcbPrivilege 3124 0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe Token: SeDebugPrivilege 2012 7f0e6956 Token: SeTcbPrivilege 2012 7f0e6956
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe"C:\Users\Admin\AppData\Local\Temp\0a1623e1341ad3d602e7978f644bc18003a998f03d51287cb1f4e01f96816abe.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Windows\Syswow64\7f0e6956C:\Windows\Syswow64\7f0e69561⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\7f0e6956
- Size 638KB
- SHA256 0636dd285e9e47c4a66d0e741ba7586a00c7e0e4e84adbdddc1aec9983c2711b
- MD5 5579457875910c931bac5bf5f8b8f131
- SHA1 11cd0ff46146a61811c9598068efe0f6f6e7eb97
- SHA512 f7aef6442ccee9cb965bce0451d46a03ea89de15185c593c96f12c30d1d0210ace8dd8fb0a6669806b3aaab057ab7e975b8d3df32849ba9b4491d0738ae78744
- SSDEEP 6144:icTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8KU5R2:iSvO2x9mONvKRwLSFtsOkx2LIa+ya5g
- TLSH T14CD46B26B6908037C0B74675C5B64BAAFAB5BC21631186CFA380761A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH