Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 12:38
Behavioral task
behavioral1
Sample
dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe
- Size 1.2MB
- Sample261014-pt98cads2s
- SHA256 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e
- MD5 6ea788c5943eab82ab18e81954fd279a
- SHA1 b2c5020cc2a3efe66236341c13acb2f4efdeb231
- SHA512 2d0de7e2115d7fa816057a0944cc59d97a263492a49cce988d1bce0007b2f442a0de32f33919a5745ab8e281129696b70f0879b715a819c9f5796dbf5cc70adb
- SSDEEP 24576:QvO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:QHHKe2WQX5QZuTtS0rQS
- TLSH T109458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3352 9dd3764c - Unexpected DNS network traffic destination 21 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 41 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 181 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 236 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 321 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 353 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 354 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 407 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 1 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 94 114.114.114.114 3352 9dd3764c Destination IP 150 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 182 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 277 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 408 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 5 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 96 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 149 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 280 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 319 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 322 223.5.5.5 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 40 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Destination IP 235 114.114.114.114 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\9dd3764c dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9dd3764c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9dd3764c -
resource yara_rule behavioral2/memory/2952-0-0x00000000003D0000-0x000000000045C000-memory.dmp upx behavioral2/files/0x000700000001b86a-2.dat upx behavioral2/memory/3352-4-0x0000000000AA0000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/2952-18-0x00000000003D0000-0x000000000045C000-memory.dmp upx behavioral2/memory/3352-19-0x0000000000AA0000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/3352-42-0x0000000000AA0000-0x0000000000B2C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\328a10 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe File opened for modification C:\Windows\396330 9dd3764c - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 9dd3764c Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 9dd3764c - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dd3764c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9dd3764c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9dd3764c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9dd3764c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9dd3764c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9dd3764c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9dd3764c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9dd3764c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9dd3764c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9dd3764c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3352 9dd3764c 3352 9dd3764c 3352 9dd3764c 3352 9dd3764c 3352 9dd3764c 3352 9dd3764c 3352 9dd3764c 3352 9dd3764c 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Token: SeTcbPrivilege 2952 dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe Token: SeDebugPrivilege 3352 9dd3764c Token: SeTcbPrivilege 3352 9dd3764c
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe"C:\Users\Admin\AppData\Local\Temp\dc5be78827df0e4814f130b791f6c10363f26def8b926e87c97cf9f8480de42e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
C:\Windows\Syswow64\9dd3764cC:\Windows\Syswow64\9dd3764c1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9dd3764c
- Size 1.2MB
- SHA256 a00a112bf6c6397306f8c1916a17b4a3c2092091e8ad075165fea6d1818d11b0
- MD5 744d9b55a997a0ee75cfdc76f1219e7f
- SHA1 09ecd39b99c3a4e5628b1981d36972f070010f67
- SHA512 1dc99db3f69ef4d3315e566d022e4a163dc186b0962115f8389e512b3dded26b6d0246136d4af98a21c10bcefaf140149e8a29395d7efaec24aa330b2cbea7a3
- SSDEEP 24576:6vO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:6HHKe2WQX5QZuTtS0rQS
- TLSH T192458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH