Analysis
- max time kernel
146s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/10/2026, 22:29
Behavioral task
behavioral1
Sample
748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe
- Size 830KB
- Sample261013-2edbaavsdx
- SHA256 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409
- MD5 3aa34d7d744ce2df52cc0d75c23a86ef
- SHA1 e565b29d4d60f5a7ccdc809b555743cb348a3c4e
- SHA512 869c1f3c6c79dee4928ca026e0a95c038ae853ded22a221f29b1daadae6f92758146c5644ca2c25614fac15d04bb73fda43a092a741c0ac845f6dfbfb7d19bb0
- SSDEEP 12288:2SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:1vO2xJKRw2kOkx2LFRvcUQPK
- TLSH T193055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4876 b08bbd6a - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 335 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 41 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 149 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 235 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 280 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 282 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 336 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 365 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 421 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 236 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 422 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 477 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 181 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 182 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 320 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 366 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 478 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 1 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 4 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 40 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 94 114.114.114.114 4876 b08bbd6a Destination IP 95 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 150 223.5.5.5 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Destination IP 319 114.114.114.114 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\b08bbd6a 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b08bbd6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b08bbd6a -
resource yara_rule behavioral2/memory/4092-0-0x0000000000D70000-0x0000000000DFC000-memory.dmp upx behavioral2/files/0x000b00000001b2ca-2.dat upx behavioral2/memory/4876-3-0x0000000000450000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4092-18-0x0000000000D70000-0x0000000000DFC000-memory.dmp upx behavioral2/memory/4876-19-0x0000000000450000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4876-44-0x0000000000450000-0x00000000004DC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\460e78 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe File opened for modification C:\Windows\537a98 b08bbd6a - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b08bbd6a Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b08bbd6a Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b08bbd6a - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b08bbd6a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b08bbd6a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b08bbd6a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b08bbd6a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b08bbd6a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b08bbd6a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b08bbd6a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b08bbd6a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b08bbd6a - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4876 b08bbd6a 4876 b08bbd6a 4876 b08bbd6a 4876 b08bbd6a 4876 b08bbd6a 4876 b08bbd6a 4876 b08bbd6a 4876 b08bbd6a 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Token: SeTcbPrivilege 4092 748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe Token: SeDebugPrivilege 4876 b08bbd6a Token: SeTcbPrivilege 4876 b08bbd6a
Processes
-
C:\Users\Admin\AppData\Local\Temp\748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe"C:\Users\Admin\AppData\Local\Temp\748faf953b56396ae8cb2d68b8c3a241a84fc07d6b875fe23ccfd3a090359409.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
C:\Windows\Syswow64\b08bbd6aC:\Windows\Syswow64\b08bbd6a1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b08bbd6a
- Size 830KB
- SHA256 5810e06209c6f72567e1824a76aaefaba405c5331a80b1f1fdba50d54ec5a629
- MD5 08fc3315fc73d2b12c333d8a1ab0f216
- SHA1 f6243ca9a9f07afa786a91ed6315014d1221030b
- SHA512 0ff8153282418a70fe2d7e83c8a01f214993ad13e16181a165cccf8fda35cc72e1807825900de102eba9a798592efd3e724f48427b86f6ed2853b4b0549bd699
- SSDEEP 12288:ySvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:ZvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T1E8055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH