Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/10/2026, 22:27
Behavioral task
behavioral1
Sample
74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe
- Size 560KB
- Sample261013-2dgbjsct51
- SHA256 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16
- MD5 e75b185d74a536634d6ade0951de74d4
- SHA1 2345a97f29e9946b552b9c648050b6021cc10a7d
- SHA512 3ca7907b7a5d629773f086167b968cad148eae50a37fa070601d81f71e1ad0a1515c9910efe75f08bfc992b088989076661acd6f95463b4f0291263ec2b48ac8
- SSDEEP 6144:76UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:7O7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T12CC46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5500 e181a184 - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 96 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 149 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 287 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 344 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 397 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 3 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 150 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 182 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 311 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 343 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 5 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 288 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 398 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 40 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 41 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 181 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 235 114.114.114.114 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 236 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 312 223.5.5.5 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Destination IP 94 114.114.114.114 5500 e181a184 - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e181a184 File created C:\Windows\SysWOW64\e181a184 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e181a184 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e181a184 -
resource yara_rule behavioral2/memory/4200-0-0x00000000009A0000-0x0000000000A2C000-memory.dmp upx behavioral2/memory/5500-3-0x00000000009D0000-0x0000000000A5C000-memory.dmp upx behavioral2/files/0x0010000000011392-4.dat upx behavioral2/memory/4200-18-0x00000000009A0000-0x0000000000A2C000-memory.dmp upx behavioral2/memory/5500-19-0x00000000009D0000-0x0000000000A5C000-memory.dmp upx behavioral2/memory/5500-42-0x00000000009D0000-0x0000000000A5C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5e2978 e181a184 File opened for modification C:\Windows\47e7d0 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e181a184 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e181a184 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e181a184 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e181a184 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e181a184 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e181a184 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e181a184 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e181a184 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e181a184 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e181a184 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e181a184 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e181a184 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5500 e181a184 5500 e181a184 5500 e181a184 5500 e181a184 5500 e181a184 5500 e181a184 5500 e181a184 5500 e181a184 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Token: SeTcbPrivilege 4200 74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe Token: SeDebugPrivilege 5500 e181a184 Token: SeTcbPrivilege 5500 e181a184
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe"C:\Users\Admin\AppData\Local\Temp\74e29e559ea82ad2d9915121df5870e336743da687dec91d2ff9b9dc1afb6a16.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
C:\Windows\Syswow64\e181a184C:\Windows\Syswow64\e181a1841⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5500
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e181a184
- Size 560KB
- SHA256 b5ebc356b766095ecac3e0311c677ff5c6e0f3e49b7cf5245a9819ad196b27bb
- MD5 8b32feef145b4f11e1def5421828469c
- SHA1 7dee5aca8dec43137706f0e21f752bf30f0cb11b
- SHA512 28dc53d9fdb55ec44d70f14ddfee61e1e8f96fa15ec470139f575c43bf6993ccc3bbff9a9e0315c29ee3d76f6a696ec95b59b3feac598aa8c29a340eded7b207
- SSDEEP 6144:H6UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:HO7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T1ECC46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH