Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 00:07
Behavioral task
behavioral1
Sample
2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe
- Size 766KB
- Sample261017-aefymaft3x
- SHA256 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792
- MD5 eef5f0fe9a9d2168ce6fae444cce9b8f
- SHA1 26dacd57b7f4b1c7e316e31f0c2a0e76d25e9603
- SHA512 ef17b2942f2751f1fddedcbc36c046c8d8db88c7748784777594b29b11c31c4233edc89df57566e94f1fafa754fbc0d510981ee81f384fd8a827aeba763e4b8b
- SSDEEP 12288:2SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:1vO2xJKRw2kOkx2LFRvcUV
- TLSH T111F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5036 4c0b4180 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 40 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 41 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 182 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 293 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 323 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 376 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 94 114.114.114.114 5036 4c0b4180 Destination IP 133 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 1 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 181 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 322 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 377 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 4 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 96 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 135 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 235 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 236 223.5.5.5 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Destination IP 292 114.114.114.114 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4c0b4180 File created C:\Windows\SysWOW64\4c0b4180 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 4c0b4180 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 4c0b4180 -
resource yara_rule behavioral2/memory/5868-0-0x0000000000A70000-0x0000000000AFC000-memory.dmp upx behavioral2/files/0x00170000000115bd-2.dat upx behavioral2/memory/5036-3-0x0000000000FD0000-0x000000000105C000-memory.dmp upx behavioral2/memory/5868-18-0x0000000000A70000-0x0000000000AFC000-memory.dmp upx behavioral2/memory/5036-19-0x0000000000FD0000-0x000000000105C000-memory.dmp upx behavioral2/memory/5036-40-0x0000000000FD0000-0x000000000105C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5637d8 4c0b4180 File opened for modification C:\Windows\647658 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 4c0b4180 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 4c0b4180 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c0b4180 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 4c0b4180 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 4c0b4180 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 4c0b4180 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 4c0b4180 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 4c0b4180 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 4c0b4180 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 4c0b4180 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 4c0b4180 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 4c0b4180 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5036 4c0b4180 5036 4c0b4180 5036 4c0b4180 5036 4c0b4180 5036 4c0b4180 5036 4c0b4180 5036 4c0b4180 5036 4c0b4180 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Token: SeTcbPrivilege 5868 2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe Token: SeDebugPrivilege 5036 4c0b4180 Token: SeTcbPrivilege 5036 4c0b4180
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe"C:\Users\Admin\AppData\Local\Temp\2c33433b69bce7f2c596459bca2c79718a6858e712ff0456bf13a4d597b74792.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5868
-
C:\Windows\Syswow64\4c0b4180C:\Windows\Syswow64\4c0b41801⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\4c0b4180
- Size 766KB
- SHA256 cdadcfebdea73f82f7ac39b69156cbca24b65e917ce728305a0f6ba19df4ae1d
- MD5 43858b3d355e700d4e9bdb70e1d6e2a7
- SHA1 a15773d457423f7d7f1d9e46394926128ed25310
- SHA512 4d2d60fa7fb86d90f26b2d984e0db2ff8f98a6a2281f973eaefd61e31f9aa2eae6fb5ea8bf3b6f6f7ab8a40b8420c27f96f09545ffa0c94922501b793567e464
- SSDEEP 12288:QSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:LvO2xJKRw2kOkx2LFRvcUV
- TLSH T108F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH