Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe
- Size 960KB
- Sample261017-gfmk5add52
- SHA256 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3
- MD5 0670aeef95bb7e6df2f6cbc40c777030
- SHA1 2be33e6150b745b5e15507ed481c6612f6ab617f
- SHA512 3cc171d2ec0f276da3d925038708be07e1cf29bb5cc53ce57f6b5a545555aec6143278433d08d4284b5c744f4ad6635706100fd3872f953675511458fcd13dbe
- SSDEEP 12288:TSvO2x9mONvKRILSFnOkx2LIaxy4n5FAQjU/u:mvO2xJKRI2FOkx2LFE4scU2
- TLSH T194253B21F6508135C4B74536C5FA0BEAA6747D21671067CBA3C07B5B2FB36D2A931B0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 816 d7b7e18c - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 181 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 279 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 113 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 217 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 218 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 322 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 369 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 436 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 498 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 557 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 47 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 370 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 402 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 437 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 558 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 325 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 48 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 112 114.114.114.114 816 d7b7e18c Destination IP 183 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 278 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 401 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 497 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 3 114.114.114.114 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 6 223.5.5.5 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d7b7e18c File created C:\Windows\SysWOW64\d7b7e18c e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d7b7e18c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d7b7e18c - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\df860 d7b7e18c File opened for modification C:\Windows\31b7b0 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d7b7e18c Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d7b7e18c Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d7b7e18c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d7b7e18c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d7b7e18c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d7b7e18c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d7b7e18c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d7b7e18c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d7b7e18c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d7b7e18c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d7b7e18c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d7b7e18c - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 816 d7b7e18c 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Token: SeTcbPrivilege 2904 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Token: SeDebugPrivilege 816 d7b7e18c Token: SeTcbPrivilege 816 d7b7e18c
Processes
-
C:\Users\Admin\AppData\Local\Temp\e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe"C:\Users\Admin\AppData\Local\Temp\e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
C:\Windows\Syswow64\d7b7e18cC:\Windows\Syswow64\d7b7e18c1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d7b7e18c
- Size 960KB
- SHA256 5ee25d39052aace8f4c7850f805aa0b0571a3002338c3462a5d719eb2db31a02
- MD5 ce9335a72a92c9ba622087b8a0527bd1
- SHA1 3a83b2a8180b114aa9696db8abe323fc0bedeffe
- SHA512 cfa19542e2f83de5073938bf033093efd70a3f60ba5f38a182df64056d083e0ab5c2f6d2e8345f3e9ebb693d38675e5e746b4a1dd83eee40a3afbaa9a89503cd
- SSDEEP 12288:/SvO2x9mONvKRILSFnOkx2LIaxy4n5FAQjU/u:KvO2xJKRI2FOkx2LFE4scU2
- TLSH T168253B21F6508135C4B74536C5FA0BEAA6747D21671067CBA3C07B5B2FB36D2A931B0E
- MD5 SHA1 SHA512 SSDEEP TLSH