Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 15:19
Behavioral task
behavioral1
Sample
5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe
- Size 525KB
- Sample261017-sqgcmsg12q
- SHA256 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0
- MD5 1f3302f2838002be310e43836bdc0d66
- SHA1 0c963a94ab65fd0ef53c0ef6a1287438250ab5e1
- SHA512 527eea44333da365b353e6abae72d41b8a0d7810d84dc93beb6ae9fde27d6333ea77a88c0e3388e9687f3311c1fa001d42d98561065930c9a10bad0cd1f5b08f
- SSDEEP 6144:VcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:VSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T14DB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1652 30a3a1e0 - Unexpected DNS network traffic destination 19 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 56 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 202 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 203 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 237 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 301 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 342 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 370 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 7 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 130 114.114.114.114 1652 30a3a1e0 Destination IP 131 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 369 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 400 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 461 223.5.5.5 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 55 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 236 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 300 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 399 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 460 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 3 114.114.114.114 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 30a3a1e0 File created C:\Windows\SysWOW64\30a3a1e0 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 30a3a1e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 30a3a1e0 -
resource yara_rule behavioral1/memory/3680-0-0x0000000000350000-0x00000000003DC000-memory.dmp upx behavioral1/files/0x000a0000000243fd-2.dat upx behavioral1/memory/1652-4-0x0000000000910000-0x000000000099C000-memory.dmp upx behavioral1/memory/3680-20-0x0000000000350000-0x00000000003DC000-memory.dmp upx behavioral1/memory/1652-21-0x0000000000910000-0x000000000099C000-memory.dmp upx behavioral1/memory/1652-38-0x0000000000910000-0x000000000099C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1c4868 30a3a1e0 File opened for modification C:\Windows\3f00c0 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 30a3a1e0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 30a3a1e0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30a3a1e0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 30a3a1e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 30a3a1e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 30a3a1e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 30a3a1e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 30a3a1e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 30a3a1e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 30a3a1e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 30a3a1e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 30a3a1e0 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 1652 30a3a1e0 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Token: SeTcbPrivilege 3680 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Token: SeDebugPrivilege 1652 30a3a1e0 Token: SeTcbPrivilege 1652 30a3a1e0
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe"C:\Users\Admin\AppData\Local\Temp\5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
C:\Windows\Syswow64\30a3a1e0C:\Windows\Syswow64\30a3a1e01⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1c4868
- Size 501B
- SHA256 547a596bec34f33924556f06744ae93c0a3fe31672dd7bab2fe212744c6a82d3
- MD5 43dc7149ac32fcdc49d8e70eecfcea86
- SHA1 e1dc18c352a9a970e5506177b9200d7277f1b177
- SHA512 3556fb0adae2950cd26034e26d18741f6206b110bf9ae9a38a3b3f81a7a285bc73cf21411f2a6a8696fb759d6782a0887091982fb9ec0c23479f08e7db142a2c
- TLSH T1EFF0C93F98253EB08DAF9A326A879C696009702E404A51254FF8BDC3C8D7201EF63C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\30a3a1e0
- Size 525KB
- SHA256 83bcefba0cab6296cd4170494bd5615aff47b84fb12685ddd9102f212ac5f714
- MD5 d70b1e5860a746835eca529acefc5bdb
- SHA1 cf1529af6658873a1f041a66ce31b4f7f53b7154
- SHA512 10dbb54e51d09d8a81574f59ffccd098f8757bc89e92a2c0d7d346fb57519af1f5dbf84caf3b5f5bdf5b40a811194f94721bcc52e4ca541bb7a9cf5bb1600dd1
- SSDEEP 6144:DcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:DSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T14EB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH