Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe
- Size 615KB
- Sample261017-eba1eswvft
- SHA256 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d
- MD5 3603abbfe51e5e94d63c98fdd1bd06ae
- SHA1 6512d0dc2f533294d11d87987cf75e190a0a230d
- SHA512 0c2946e263c6514041ad986f15da2df8c08ce58b1614c60ca3a113740726a282cee64dfdb6d5d5d54d3120084bfcc480c9b277565d7fb41c22348051e5455bd1
- SSDEEP 12288:hSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:ovO2xJKRI2FOkx2LFicUV
- TLSH T1A2D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3892 1f1e4858 - Unexpected DNS network traffic destination 21 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 39 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 149 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 389 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 5 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 40 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 235 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 335 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 336 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 390 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 2 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 94 114.114.114.114 3892 1f1e4858 Destination IP 95 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 181 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 285 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 303 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 304 223.5.5.5 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 443 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 148 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 180 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 234 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Destination IP 283 114.114.114.114 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1f1e4858 File created C:\Windows\SysWOW64\1f1e4858 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1f1e4858 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1f1e4858 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\556578 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe File opened for modification C:\Windows\42a1e8 1f1e4858 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1f1e4858 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1f1e4858 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1f1e4858 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1f1e4858 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1f1e4858 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1f1e4858 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1f1e4858 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1f1e4858 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1f1e4858 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1f1e4858 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1f1e4858 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1f1e4858 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 3892 1f1e4858 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Token: SeTcbPrivilege 4988 2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe Token: SeDebugPrivilege 3892 1f1e4858 Token: SeTcbPrivilege 3892 1f1e4858
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe"C:\Users\Admin\AppData\Local\Temp\2c39bd8d09eea54488c429b30039a31ef954104fde5950b3febc05f82a82af4d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
C:\Windows\Syswow64\1f1e4858C:\Windows\Syswow64\1f1e48581⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\42a1e8
- Size 654B
- SHA256 34e76aaf39639205c1bc864a0f80329ed0d7249e8c1f007e41cf3187473a759e
- MD5 1e2ade5f05357d0a157e2cf0aa40f2dc
- SHA1 0cb750afd54073806a05794840311eab939eaa78
- SHA512 e4ecd41551ab8cd1f8eb3fccb616a54f470d553f194078ae4c14fd2aea08ab5731a763d54e70f7664a1ea084ea111a5a9e5552f095191c51296ca3c445ca366e
- TLSH T1E3F049329884EFF15C9D847479F3CEEC2B3136C6D6C7512318D2A5AA31236A8C452003
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\1f1e4858
- Size 615KB
- SHA256 ffe18e848637158985542a81e41ea13c92fc011f6da158b0464852223456f2e8
- MD5 4b43e533961cd271e3190cb061f6119a
- SHA1 e68bf855e3d913efce3b4417f03a68ac201f702e
- SHA512 cf0fd89aee1c9cdc754e65cdf8906db5dde521eeb478741372d0a1ea43aed598d263178a14f59e159d1382c0258f25041928e1b92eb46e861b6e84350f86ef6a
- SSDEEP 12288:jSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:WvO2xJKRI2FOkx2LFicUV
- TLSH T1E9D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH