Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 20:03
Behavioral task
behavioral1
Sample
819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe
- Size 560KB
- Sample261012-ys6cfaew7x
- SHA256 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e
- MD5 c40d85f9c24d32411f7cf96018e32c3d
- SHA1 b1a8a9cad58936bdd91e5835d6c6249599eb1ff9
- SHA512 55ecb72b95b3b0c15246903ee91cc0e8c6be4071fe2414e32162b8f3af70c20eff559870bcdf2d46bbc35a0310e171f0b711e9aad9173215d06c1252d2b5b7e7
- SSDEEP 6144:IUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:IYsVOdhElvkCgvDLe4usOkxHy
- TLSH T1DAC48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4100 bcf554b8 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 2 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 36 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 144 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 145 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 339 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 176 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 231 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 285 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 393 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 89 114.114.114.114 4100 bcf554b8 Destination IP 230 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 284 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 336 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 392 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 447 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 35 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 90 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 177 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 306 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 307 223.5.5.5 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Destination IP 446 114.114.114.114 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bcf554b8 File created C:\Windows\SysWOW64\bcf554b8 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bcf554b8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bcf554b8 -
resource yara_rule behavioral2/memory/4884-0-0x0000000000590000-0x000000000061C000-memory.dmp upx behavioral2/files/0x000700000001b8af-2.dat upx behavioral2/memory/4100-3-0x0000000000A40000-0x0000000000ACC000-memory.dmp upx behavioral2/memory/4884-20-0x0000000000590000-0x000000000061C000-memory.dmp upx behavioral2/memory/4100-21-0x0000000000A40000-0x0000000000ACC000-memory.dmp upx behavioral2/memory/4100-44-0x0000000000A40000-0x0000000000ACC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\463188 bcf554b8 File opened for modification C:\Windows\539da8 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname bcf554b8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain bcf554b8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcf554b8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bcf554b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bcf554b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bcf554b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bcf554b8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bcf554b8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bcf554b8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bcf554b8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bcf554b8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bcf554b8 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4100 bcf554b8 4100 bcf554b8 4100 bcf554b8 4100 bcf554b8 4100 bcf554b8 4100 bcf554b8 4100 bcf554b8 4100 bcf554b8 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Token: SeTcbPrivilege 4884 819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe Token: SeDebugPrivilege 4100 bcf554b8 Token: SeTcbPrivilege 4100 bcf554b8
Processes
-
C:\Users\Admin\AppData\Local\Temp\819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe"C:\Users\Admin\AppData\Local\Temp\819835eaa6285779c71b19dfcb5f95187aac8ad75f580c3d6267b5f6d9d4f10e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
C:\Windows\Syswow64\bcf554b8C:\Windows\Syswow64\bcf554b81⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\bcf554b8
- Size 560KB
- SHA256 ef95685a638fc62ce61ce8038dbe187e1e589de48a274709076237a8ac730dfb
- MD5 45534240c84481e3a439de4c4fcb657e
- SHA1 38986954906ae58ab50cb7c4460a91d6861100ff
- SHA512 84b3d7887f9a5b248368fc8b4aaddf5f6fbd6bd541c5ac146e2261b397f08045be6cb14b64937aa5e9317f8462318e2ea738744e86526d48fdf1c20516da2e00
- SSDEEP 6144:fUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:fYsVOdhElvkCgvDLe4usOkxHy
- TLSH T141C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH