Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 20:10
Behavioral task
behavioral1
Sample
c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe
- Size 560KB
- Sample261012-yxsbdaef24
- SHA256 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3
- MD5 afcf316ec1112a7d66ad51be3322707f
- SHA1 bffc60c70cb93b7b70b7d9f645b6356137e2d519
- SHA512 a89ea4970e1f257ca20a1bbd530f23023dda178410bae7f031b5e4a383a42a62f1567e16c8593cffed783a3d65a7ef522a50b29daffbfc88de0eb5a6f759e392
- SSDEEP 6144:6gye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:6I7OE4kopQzNKFyLWDHsOkxHy
- TLSH T1EFC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2912 e7992cde - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 94 114.114.114.114 2912 e7992cde Destination IP 95 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 149 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 150 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 181 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 327 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 470 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 501 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 3 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 41 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 319 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 320 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 284 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 1 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 182 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 282 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 326 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 357 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 412 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 413 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 40 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 235 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 236 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 356 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 471 223.5.5.5 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Destination IP 500 114.114.114.114 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e7992cde File created C:\Windows\SysWOW64\e7992cde c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e7992cde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e7992cde -
resource yara_rule behavioral2/memory/2508-0-0x0000000000B00000-0x0000000000B8C000-memory.dmp upx behavioral2/files/0x000600000001b867-2.dat upx behavioral2/memory/2912-3-0x00000000004A0000-0x000000000052C000-memory.dmp upx behavioral2/memory/2508-18-0x0000000000B00000-0x0000000000B8C000-memory.dmp upx behavioral2/memory/2912-19-0x00000000004A0000-0x000000000052C000-memory.dmp upx behavioral2/memory/2912-44-0x00000000004A0000-0x000000000052C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\31dac0 e7992cde File opened for modification C:\Windows\2af018 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e7992cde Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e7992cde Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7992cde - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e7992cde Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e7992cde Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e7992cde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e7992cde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e7992cde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e7992cde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e7992cde Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e7992cde Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e7992cde - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2912 e7992cde 2912 e7992cde 2912 e7992cde 2912 e7992cde 2912 e7992cde 2912 e7992cde 2912 e7992cde 2912 e7992cde 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Token: SeTcbPrivilege 2508 c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe Token: SeDebugPrivilege 2912 e7992cde Token: SeTcbPrivilege 2912 e7992cde
Processes
-
C:\Users\Admin\AppData\Local\Temp\c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe"C:\Users\Admin\AppData\Local\Temp\c050bc055af07b63f2df18c24af9999dbfde8c6c25fbd51f7f7688967b5730b3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
C:\Windows\Syswow64\e7992cdeC:\Windows\Syswow64\e7992cde1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e7992cde
- Size 560KB
- SHA256 76ea908fffab1e213f68fb2ce4f63eb8e568992e997b05bf8fc827f6ec6f3be9
- MD5 9cdcb151e5cd0d990ae8a9dbc4b0a20f
- SHA1 3660a68f016c8dade5b19a0717db84bc8bb39c55
- SHA512 e37cbbfd453e8d40389774d6593a2725e113499befc59933af62ab3530ada129a502ccb604d607e857dc4528814ed5f0f59dd9f63736fd499ebf4f7dc2771270
- SSDEEP 6144:ogye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:oI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T10DC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH