Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe
- Size 960KB
- Sample261017-gfmk5add52
- SHA256 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3
- MD5 0670aeef95bb7e6df2f6cbc40c777030
- SHA1 2be33e6150b745b5e15507ed481c6612f6ab617f
- SHA512 3cc171d2ec0f276da3d925038708be07e1cf29bb5cc53ce57f6b5a545555aec6143278433d08d4284b5c744f4ad6635706100fd3872f953675511458fcd13dbe
- SSDEEP 12288:TSvO2x9mONvKRILSFnOkx2LIaxy4n5FAQjU/u:mvO2xJKRI2FOkx2LFE4scU2
- TLSH T194253B21F6508135C4B74536C5FA0BEAA6747D21671067CBA3C07B5B2FB36D2A931B0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2860 5d69dc6d - Unexpected DNS network traffic destination 23 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 148 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 321 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 95 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 149 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 239 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 242 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 463 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 5 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 93 114.114.114.114 2860 5d69dc6d Destination IP 180 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 235 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 352 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 353 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 406 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 3 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 181 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 234 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 298 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 320 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 407 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 464 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 39 114.114.114.114 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Destination IP 40 223.5.5.5 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\5d69dc6d e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5d69dc6d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5d69dc6d - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\30f6d8 5d69dc6d File opened for modification C:\Windows\548190 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5d69dc6d Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5d69dc6d Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d69dc6d Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5d69dc6d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5d69dc6d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5d69dc6d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5d69dc6d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5d69dc6d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5d69dc6d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5d69dc6d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5d69dc6d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5d69dc6d - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2860 5d69dc6d 2860 5d69dc6d 2860 5d69dc6d 2860 5d69dc6d 2860 5d69dc6d 2860 5d69dc6d 2860 5d69dc6d 2860 5d69dc6d 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Token: SeTcbPrivilege 4936 e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe Token: SeDebugPrivilege 2860 5d69dc6d Token: SeTcbPrivilege 2860 5d69dc6d
Processes
-
C:\Users\Admin\AppData\Local\Temp\e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe"C:\Users\Admin\AppData\Local\Temp\e36ecabb2f6a37a61d5db508895e1a6e3b82bea599a98d7b2b2c7c0d5a3d7cd3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
C:\Windows\Syswow64\5d69dc6dC:\Windows\Syswow64\5d69dc6d1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5d69dc6d
- Size 960KB
- SHA256 60aaa888d9250fca4f352bc122c348c2c77cd847daa2d70d4ee68e8514b885f9
- MD5 7bde538d11ed51d112f0cb86485fcc9c
- SHA1 8f23593fcf7cd7600216524fce8e4cf032857f3f
- SHA512 2d742c33700024517135587d861e7810fcd7aa3c126165c30a7081a78dd81c0676d1433a7d9890cf76f7728b25e6df220de0d537c6835411dcb226d3cc754292
- SSDEEP 12288:RSvO2x9mONvKRILSFnOkx2LIaxy4n5FAQjU/u:4vO2xJKRI2FOkx2LFE4scU2
- TLSH T19C253B21F6508135C4B74536C5FA0BEAA6747D21671067CBA3C07B5B2FB36D2A931B0E
- MD5 SHA1 SHA512 SSDEEP TLSH