Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 07:13
Behavioral task
behavioral1
Sample
b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe
- Size 638KB
- Sample261017-h2g37sby21
- SHA256 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323
- MD5 834acd527550acf69bb47a51efd118d3
- SHA1 3fe087d0ef34f7908bbc72c11fbae4cc61d5440e
- SHA512 ae53b21e709865fa2bafd02faa93fd7c418d704cae53f275c66bd42b873fc8687a4fea5a6669b3c0612587819584f736b47df6623edd9d594f4cf9e307fcb2c0
- SSDEEP 6144:hcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8KU5R2:hSvO2x9mONvKRwLSFtsOkx2LIa+ya5g
- TLSH T1ABD46B26B6908037C0B74675C5B64BAAFAB5BC21631186CFA380761A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2936 6b14c0f4 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 40 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 41 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 181 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 235 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 1 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 4 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 95 114.114.114.114 2936 6b14c0f4 Destination IP 96 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 132 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 182 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 236 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 322 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 292 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 293 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 323 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 376 114.114.114.114 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 377 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Destination IP 134 223.5.5.5 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 6b14c0f4 File created C:\Windows\SysWOW64\6b14c0f4 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 6b14c0f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 6b14c0f4 -
resource yara_rule behavioral2/memory/832-0-0x0000000000AA0000-0x0000000000B2C000-memory.dmp upx behavioral2/files/0x0009000000019cb3-2.dat upx behavioral2/memory/2936-3-0x0000000000FF0000-0x000000000107C000-memory.dmp upx behavioral2/memory/832-18-0x0000000000AA0000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/2936-19-0x0000000000FF0000-0x000000000107C000-memory.dmp upx behavioral2/memory/2936-40-0x0000000000FF0000-0x000000000107C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3243f0 6b14c0f4 File opened for modification C:\Windows\e3e80 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 6b14c0f4 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 6b14c0f4 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b14c0f4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 6b14c0f4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 6b14c0f4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 6b14c0f4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 6b14c0f4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 6b14c0f4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 6b14c0f4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 6b14c0f4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 6b14c0f4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 6b14c0f4 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2936 6b14c0f4 2936 6b14c0f4 2936 6b14c0f4 2936 6b14c0f4 2936 6b14c0f4 2936 6b14c0f4 2936 6b14c0f4 2936 6b14c0f4 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Token: SeTcbPrivilege 832 b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe Token: SeDebugPrivilege 2936 6b14c0f4 Token: SeTcbPrivilege 2936 6b14c0f4
Processes
-
C:\Users\Admin\AppData\Local\Temp\b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe"C:\Users\Admin\AppData\Local\Temp\b73328c29e260054079cfa8229d5681db692379dd46623a4f49422caaaccc323.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
C:\Windows\Syswow64\6b14c0f4C:\Windows\Syswow64\6b14c0f41⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\6b14c0f4
- Size 638KB
- SHA256 428004315f769cca134a7ee649ec6bd3071b2771c4c17a1c054936ab56be2511
- MD5 9eba2112cf93fae968fb2ad593902187
- SHA1 c9c9f27f792bdb115b0ef5b03e820b4f0848b296
- SHA512 47775ad56ca60d594444d4025a4e3feacd948c8542600adcd0b62b5dfaeafd748241d237db1c5e6d9026c5c6ac195e273031dcf6b47d1fe4663833c22524d20f
- SSDEEP 6144:KcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8KU5R2:KSvO2x9mONvKRwLSFtsOkx2LIa+ya5g
- TLSH T1DAD46B26B6908037C0B74675C5B64BAAFAB5BC21631186CFA380761A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH