ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Size 419KB
Sample261012-ymqd2aev7x
SHA256 ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813
MD5 93d46c39224fbcc9d120ce12404e348b
SHA1 98b1a850939ea83fdcc8eee23164bda8dbe8a1f2
SHA512 cc9e95b01be8f7a9404e90026960af7f7d429841d5e9a4194bca001f487a63f3503f86c44756401747ac722f89ea69975a50ac3f7969923ac04e7e7c25d89163
SSDEEP 6144:jatygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:jatG+S9+kaTDHrOkx2LIa
TLSH
T183948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5924	509c4f08

Unexpected DNS network traffic destination 28 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	148	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	180	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	235	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	320	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	372	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	401	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	402	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	4	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	94	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	234	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	279	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	281	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	319	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	371	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	457	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	149	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	181	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	605	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	606	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	39	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	40	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	93	114.114.114.114	5924	509c4f08
Destination IP	460	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	516	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	517	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	546	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	547	223.5.5.5	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Destination IP	1	114.114.114.114	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	509c4f08
File created	C:\Windows\SysWOW64\509c4f08	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	509c4f08
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	509c4f08

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\656bc8	509c4f08
File opened for modification	C:\Windows\48ba30	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	509c4f08
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	509c4f08
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	509c4f08

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	509c4f08
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	509c4f08
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	509c4f08
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	509c4f08
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	509c4f08
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	509c4f08
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	509c4f08
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	509c4f08
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	509c4f08

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5924	509c4f08
5924	509c4f08
5924	509c4f08
5924	509c4f08
5924	509c4f08
5924	509c4f08
5924	509c4f08
5924	509c4f08
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Token: SeTcbPrivilege	4248	ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
Token: SeDebugPrivilege	5924	509c4f08
Token: SeTcbPrivilege	5924	509c4f08

C:\Users\Admin\AppData\Local\Temp\ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe
"C:\Users\Admin\AppData\Local\Temp\ddcf1d121e3225d5568786b9764cbd2c10778ed670353419ad1e0f532d034813.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\Syswow64\509c4f08
C:\Windows\Syswow64\509c4f08
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

509c4f08

Path C:\Windows\SysWOW64\509c4f08
Size 419KB
SHA256 9a458c2c04be78defa447f146ba99f041a930e7eac864c4f29d26bec3b4513e4
MD5 205bc15549bc7a23c69b2aa8488fc10c
SHA1 327f8a4859f1c6b620ef684808d0c4f452d3adaf
SHA512 f44ee1c6fa76161b059b1ef652a9ce46e41dd34a4e55bb295ccec082fd274dd73ad813d04a8a1ff6f41c503fa97096bc47028dd6c8269ea5c0cd5fa9cd0406a0
SSDEEP 6144:0atygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:0atG+S9+kaTDHrOkx2LIa
TLSH
T155948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download