Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 02:34
Behavioral task
behavioral1
Sample
6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe
- Size 2.5MB
- Sample261014-c2gjsae18l
- SHA256 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4
- MD5 5108bcbe2269755773e80c1ceccac4d3
- SHA1 da2e2fdd2be98c9a878520bd977787bc4f3b47a5
- SHA512 a99e902dec75e32f995e1c44d57ac0fef0a020f840b001b04af74dd9260781e580200752cabf63eb725ba6cb8563aa282fa616b3e59d76fa34bb43ec8beb7a7e
- SSDEEP 49152:0HHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:0nKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T1B4C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5400 e839d7ac - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 453 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 95 114.114.114.114 5400 e839d7ac Destination IP 42 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 150 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 181 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 182 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 282 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 284 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 344 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 1 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 41 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 235 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 346 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 399 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 454 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 4 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 96 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 149 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 236 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 313 114.114.114.114 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 314 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Destination IP 400 223.5.5.5 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e839d7ac File created C:\Windows\SysWOW64\e839d7ac 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e839d7ac File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e839d7ac -
resource yara_rule behavioral2/memory/2616-0-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000600000001b857-2.dat upx behavioral2/memory/5400-3-0x0000000000C60000-0x0000000000CEC000-memory.dmp upx behavioral2/memory/2616-18-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/5400-19-0x0000000000C60000-0x0000000000CEC000-memory.dmp upx behavioral2/memory/5400-42-0x0000000000C60000-0x0000000000CEC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5c7330 e839d7ac File opened for modification C:\Windows\2cc970 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e839d7ac Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e839d7ac Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e839d7ac - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e839d7ac Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e839d7ac Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e839d7ac Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e839d7ac Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e839d7ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e839d7ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e839d7ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e839d7ac Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e839d7ac - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5400 e839d7ac 5400 e839d7ac 5400 e839d7ac 5400 e839d7ac 5400 e839d7ac 5400 e839d7ac 5400 e839d7ac 5400 e839d7ac 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Token: SeTcbPrivilege 2616 6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe Token: SeDebugPrivilege 5400 e839d7ac Token: SeTcbPrivilege 5400 e839d7ac
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe"C:\Users\Admin\AppData\Local\Temp\6ea6e87b1bb3fde33fdaa85c68630ea03d487fab98fa34cd9a05c56045455fe4.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
C:\Windows\Syswow64\e839d7acC:\Windows\Syswow64\e839d7ac1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e839d7ac
- Size 2.5MB
- SHA256 e4ec174aefc89b6208b28b9dce15130afeb9e58fee231a07095ecbcb125e41f3
- MD5 78d5eb8f590020108640f0a63a0aed60
- SHA1 917d0144f354f832103486019865cf09e71e0ef2
- SHA512 eb2458a52dc736e9be004868948e8cf57f95ee0eb927455998d6d268bacee0af415dd289870fda67ae0fc0003310a9b732edd548b664b76bef51b545044b809c
- SSDEEP 49152:7HHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:7nKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T172C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH