Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 04:38
Behavioral task
behavioral1
Sample
0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe
- Size 560KB
- Sample261017-e9kbrahz4v
- SHA256 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502
- MD5 9412bf0b839308589360653be3645abd
- SHA1 0d3f46c5fe08d98236ac89295d69fc1083613cd3
- SHA512 50cd8eee87bf7d2cc59d058215362ffd7cdbc073daed8a1bc7cb8a725821820897b0e848ed98f54c9a482c0f5446b303f259d9a9bba6f5c92787f8eb9b82cde1
- SSDEEP 12288:e3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:OVOL4/gPXKCOkx2LFR
- TLSH T141C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4128 46b81bab - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 94 114.114.114.114 4128 46b81bab Destination IP 150 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 181 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 182 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 236 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 282 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 4 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 95 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 285 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 362 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 417 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 477 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 478 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 149 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 235 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 319 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 320 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 332 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 361 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 508 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 509 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 1 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 40 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 41 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 331 114.114.114.114 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Destination IP 418 223.5.5.5 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 46b81bab File created C:\Windows\SysWOW64\46b81bab 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 46b81bab File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 46b81bab -
resource yara_rule behavioral2/memory/4304-0-0x0000000000BE0000-0x0000000000C6C000-memory.dmp upx behavioral2/files/0x000c000000019ca4-2.dat upx behavioral2/memory/4128-3-0x00000000008E0000-0x000000000096C000-memory.dmp upx behavioral2/memory/4304-18-0x0000000000BE0000-0x0000000000C6C000-memory.dmp upx behavioral2/memory/4128-19-0x00000000008E0000-0x000000000096C000-memory.dmp upx behavioral2/memory/4128-44-0x00000000008E0000-0x000000000096C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\46ac40 46b81bab File opened for modification C:\Windows\49afa0 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 46b81bab Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 46b81bab Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46b81bab Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 46b81bab Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 46b81bab Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 46b81bab Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 46b81bab Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 46b81bab Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 46b81bab Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 46b81bab Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 46b81bab Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 46b81bab - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4128 46b81bab 4128 46b81bab 4128 46b81bab 4128 46b81bab 4128 46b81bab 4128 46b81bab 4128 46b81bab 4128 46b81bab 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Token: SeTcbPrivilege 4304 0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe Token: SeDebugPrivilege 4128 46b81bab Token: SeTcbPrivilege 4128 46b81bab
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe"C:\Users\Admin\AppData\Local\Temp\0bdb5b38e7d1e3adc099208670871dd2bb83ac2075109ada3b4583405f488502.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\Syswow64\46b81babC:\Windows\Syswow64\46b81bab1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\46b81bab
- Size 560KB
- SHA256 85f833c3edbef4802939abc338e514dc04c706b475e50acb8666488758aaf04f
- MD5 c76b41b65c8052d4b2a1a9cab0301e98
- SHA1 4f2ea6627cb5dab1e9503d3432ce1f46ba280799
- SHA512 0f5a6bc243f65ee60ac1bb4b32cf0461b7734134ac05622c2bf7ca7880586435a86cb01b4e861906a386ca6640bb8383a8534b675587fb29a4cd17133f2a73dd
- SSDEEP 12288:t3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:PVOL4/gPXKCOkx2LFR
- TLSH T137C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH