Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 04:36
Behavioral task
behavioral1
Sample
d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe
- Size 525KB
- Sample261017-e8d4cahw2n
- SHA256 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3
- MD5 3d55617c32be848d947e20809d6b4470
- SHA1 6a0a841d5c603ffacce6461eb0324214b7cfd4cc
- SHA512 b56a1ed45eb82fe7a714cae47e3941d519d3e64396349ab872dedbc7c776b54cb38410a1c1410dbe99ded6d479a0c27ac60c17a9172c28b1004eaf2848dc5a77
- SSDEEP 6144:gcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:gSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T18FB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1648 dce260df - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 349 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 381 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 442 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 6 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 46 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 181 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 217 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 278 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 350 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 441 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 113 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 279 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 313 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 328 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 380 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 112 114.114.114.114 1648 dce260df Destination IP 218 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 3 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 47 223.5.5.5 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Destination IP 180 114.114.114.114 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\dce260df d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 dce260df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 dce260df -
resource yara_rule behavioral1/memory/4956-0-0x0000000000600000-0x000000000068C000-memory.dmp upx behavioral1/files/0x000700000001e6e2-2.dat upx behavioral1/memory/1648-3-0x0000000000640000-0x00000000006CC000-memory.dmp upx behavioral1/memory/4956-18-0x0000000000600000-0x000000000068C000-memory.dmp upx behavioral1/memory/1648-19-0x0000000000640000-0x00000000006CC000-memory.dmp upx behavioral1/memory/1648-38-0x0000000000640000-0x00000000006CC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1c36e0 dce260df File opened for modification C:\Windows\54d938 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dce260df Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dce260df Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dce260df - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dce260df Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dce260df Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" dce260df Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" dce260df Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dce260df Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dce260df Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dce260df Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" dce260df Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" dce260df - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1648 dce260df 1648 dce260df 1648 dce260df 1648 dce260df 1648 dce260df 1648 dce260df 1648 dce260df 1648 dce260df 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Token: SeTcbPrivilege 4956 d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe Token: SeDebugPrivilege 1648 dce260df Token: SeTcbPrivilege 1648 dce260df
Processes
-
C:\Users\Admin\AppData\Local\Temp\d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe"C:\Users\Admin\AppData\Local\Temp\d21e52aa2fdbb78e68e252e91fe5b0f850c9c917981bf6938bb522126c6477d3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
C:\Windows\Syswow64\dce260dfC:\Windows\Syswow64\dce260df1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\dce260df
- Size 525KB
- SHA256 b623e0f57264d18c0329e87f4ff3dcaac80b6ab28065a1306f350d072c979326
- MD5 7709a706230cdc8dfc8b9980586e4e3a
- SHA1 d675e682ea8f135e5e3d88a97b7a05b46d7bbbca
- SHA512 ad635d38850d578ca97f7eb948490b91d4990a4c6bb132f45f5425e0e9342115e4076709357688ef8a4b7d59bc4e3a54a21e965be0113c60c3fdd6055123d74d
- SSDEEP 6144:rcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:rSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T154B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH