Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 07:34
Behavioral task
behavioral1
Sample
b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe
- Size 525KB
- Sample261017-jelnjsvx5r
- SHA256 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66
- MD5 fd483d59a3eebc47d97164e33c42f759
- SHA1 f4c6722a23b264440e9b27ec69c2e2698cc3a0b3
- SHA512 4ee8c566271396b468cc6475b36d8d350279049859f76608ed3621a8fab2a770847c9c618391ebb6be8979e4b53f90f3a4b9ef858a537386840a6a0a02c62ef3
- SSDEEP 6144:KcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:KSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T132B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4988 af152500 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 390 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 449 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 150 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 290 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 448 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 40 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 41 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 335 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 4 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 96 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 181 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 236 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 289 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 304 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 305 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 391 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 1 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 94 114.114.114.114 4988 af152500 Destination IP 149 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 182 223.5.5.5 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 235 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Destination IP 334 114.114.114.114 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af152500 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af152500 File created C:\Windows\SysWOW64\af152500 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe -
resource yara_rule behavioral2/memory/3576-0-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral2/files/0x000800000001138c-2.dat upx behavioral2/memory/4988-3-0x0000000000F90000-0x000000000101C000-memory.dmp upx behavioral2/memory/3576-16-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral2/memory/4988-17-0x0000000000F90000-0x000000000101C000-memory.dmp upx behavioral2/memory/4988-42-0x0000000000F90000-0x000000000101C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\556578 af152500 File opened for modification C:\Windows\3d38f0 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname af152500 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain af152500 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af152500 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing af152500 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix af152500 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" af152500 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" af152500 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ af152500 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" af152500 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" af152500 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" af152500 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" af152500 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4988 af152500 4988 af152500 4988 af152500 4988 af152500 4988 af152500 4988 af152500 4988 af152500 4988 af152500 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Token: SeTcbPrivilege 3576 b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe Token: SeDebugPrivilege 4988 af152500 Token: SeTcbPrivilege 4988 af152500
Processes
-
C:\Users\Admin\AppData\Local\Temp\b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe"C:\Users\Admin\AppData\Local\Temp\b28688f82b9d24da7230034341cf1a5a655451085055e4443fca3e8d46b80d66.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
C:\Windows\Syswow64\af152500C:\Windows\Syswow64\af1525001⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\af152500
- Size 525KB
- SHA256 680b3e3468e387b0c6f9c495513166cc7e6013497d4fbddd9c8cc4d050b60440
- MD5 4ab1c67ca0086bad2d4057d774ed1261
- SHA1 3eee176035a4faa8a49c4466488152e21b974342
- SHA512 7f49152e6ec4eaa2ff9ab2afe38a93a51e744def50ee63e13fb19fbfcfca5dbfa1ab864f215d14dca7ccd42274ef06adc8b84d7757f00d40b017dc4a55fe10a2
- SSDEEP 6144:/cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:/SvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T14FB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH