Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 15:19
Behavioral task
behavioral1
Sample
5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe
- Size 525KB
- Sample261017-sqgcmsg12q
- SHA256 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0
- MD5 1f3302f2838002be310e43836bdc0d66
- SHA1 0c963a94ab65fd0ef53c0ef6a1287438250ab5e1
- SHA512 527eea44333da365b353e6abae72d41b8a0d7810d84dc93beb6ae9fde27d6333ea77a88c0e3388e9687f3311c1fa001d42d98561065930c9a10bad0cd1f5b08f
- SSDEEP 6144:VcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:VSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T14DB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3668 18d1f1e - Unexpected DNS network traffic destination 23 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 95 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 149 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 150 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 317 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 347 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 403 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 457 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 94 114.114.114.114 3668 18d1f1e Destination IP 182 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 235 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 487 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 2 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 236 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 282 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 318 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 404 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 40 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 41 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 181 114.114.114.114 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 285 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 349 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Destination IP 458 223.5.5.5 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\18d1f1e 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 18d1f1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 18d1f1e -
resource yara_rule behavioral2/memory/2376-0-0x0000000000750000-0x00000000007DC000-memory.dmp upx behavioral2/memory/3668-3-0x0000000000F20000-0x0000000000FAC000-memory.dmp upx behavioral2/files/0x000600000001b857-2.dat upx behavioral2/memory/2376-18-0x0000000000750000-0x00000000007DC000-memory.dmp upx behavioral2/memory/3668-19-0x0000000000F20000-0x0000000000FAC000-memory.dmp upx behavioral2/memory/3668-42-0x0000000000F20000-0x0000000000FAC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3ecc28 18d1f1e File opened for modification C:\Windows\28ad90 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 18d1f1e Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 18d1f1e Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18d1f1e - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 18d1f1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 18d1f1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 18d1f1e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 18d1f1e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 18d1f1e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 18d1f1e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 18d1f1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 18d1f1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 18d1f1e - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3668 18d1f1e 3668 18d1f1e 3668 18d1f1e 3668 18d1f1e 3668 18d1f1e 3668 18d1f1e 3668 18d1f1e 3668 18d1f1e 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Token: SeTcbPrivilege 2376 5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe Token: SeDebugPrivilege 3668 18d1f1e Token: SeTcbPrivilege 3668 18d1f1e
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe"C:\Users\Admin\AppData\Local\Temp\5ae4d378ba68824a094ed0c76777e0cd4883a2db99e8c2fa616ad905bed458b0.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
C:\Windows\Syswow64\18d1f1eC:\Windows\Syswow64\18d1f1e1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\18d1f1e
- Size 525KB
- SHA256 34f8a2d0e660cb68dddeab8cfeb2db1506b719889028e97a5372176c4a19b5f8
- MD5 f3614a4b2dbbf0ddba1dfed056b59932
- SHA1 b8669050603d2a1a4e72778409c5dc1e08a098c6
- SHA512 5df253def066b0dbc3e06390dd63dcff063e4e7f9785f90a6ffa3133551f28a760ccf006b73c4441b0a3f15a951bfd1f9259e30731d6b822f2e7260fcf07532d
- SSDEEP 6144:KcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:KSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T1C7B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH