Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/10/2026, 20:03
Behavioral task
behavioral1
Sample
d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe
- Size 830KB
- Sample261012-ysrt2sew7s
- SHA256 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d
- MD5 977ea980a818d701087b16fc39f715bf
- SHA1 621e1e8c3cfb74bb5572a68e7936e5192882ab8f
- SHA512 edb26e71427d7dfb46ab454eff7412c627ee30a2128d39a11098cf9bc54fd527d30d39c502ff7fba79ee4023a371963d6874ab0d79840ed09282c5fdff002146
- SSDEEP 12288:9SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:cvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T11E055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4548 b3f49d6b - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 47 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 112 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 279 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 6 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 46 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 211 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 344 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 375 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 436 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 437 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 3 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 140 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 142 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 209 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 376 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 111 114.114.114.114 4548 b3f49d6b Destination IP 278 114.114.114.114 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 345 223.5.5.5 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b3f49d6b File created C:\Windows\SysWOW64\b3f49d6b d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b3f49d6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b3f49d6b -
resource yara_rule behavioral1/memory/4520-0-0x0000000000100000-0x000000000018C000-memory.dmp upx behavioral1/files/0x0012000000023267-2.dat upx behavioral1/memory/4548-4-0x0000000000D10000-0x0000000000D9C000-memory.dmp upx behavioral1/memory/4520-18-0x0000000000100000-0x000000000018C000-memory.dmp upx behavioral1/memory/4548-19-0x0000000000D10000-0x0000000000D9C000-memory.dmp upx behavioral1/memory/4548-38-0x0000000000D10000-0x0000000000D9C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4ddd08 b3f49d6b File opened for modification C:\Windows\4d6250 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b3f49d6b Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b3f49d6b Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b3f49d6b - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b3f49d6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b3f49d6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b3f49d6b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b3f49d6b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b3f49d6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b3f49d6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b3f49d6b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b3f49d6b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b3f49d6b - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4548 b3f49d6b 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Token: SeTcbPrivilege 4520 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Token: SeDebugPrivilege 4548 b3f49d6b Token: SeTcbPrivilege 4548 b3f49d6b
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe"C:\Users\Admin\AppData\Local\Temp\d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
C:\Windows\Syswow64\b3f49d6bC:\Windows\Syswow64\b3f49d6b1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b3f49d6b
- Size 830KB
- SHA256 6933b374d19327e60cd5662e390dfd9d622ea4efe0b1a0bb8d9c99e4d0139741
- MD5 0e112bb190b027da41fc68546eb65432
- SHA1 cb3119a5debc8314e4c59f36eaa20e4088f73a5a
- SHA512 afee0a4f6ddfbb814ed7247d6fa80295c0c9607ee4d06289875ed9ca6389c2ebf05da1de113f37c5ca07910c8c51df4fc65a28d6c2defe96215ab2e3aa3405c8
- SSDEEP 12288:TSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:mvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T134055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH