MALICIOUS — 05696df094461a8c9e3cb3f2154b3bee656147fb2b631626250e9ae96665014c.exe

MALICIOUS — 05696df094461a8c9e3cb3f2154b3bee656147fb2b631626250e9ae96665014c.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dmww family. 4 of 25 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 05696df094461a8c9e3cb3f2154b3bee656147fb2b631626250e9ae96665014c
SHA-1: 56cc874b76a1e5aa644dd26906a1291663d752d2
MD5: 725609e4ea218f4f5e2133fecbe554d1
imphash: 42492c8bc2aad1800e134cedaf5754c9
ssdeep: 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMTR:9XhICteErownP0oTcMsABqlDQk6
TLSH: T17565331646027392EEF3E860EC409D4D8473B2A96873E59C6987CD5D30E9D33E8F0A56
Submitted as: 05696df094461a8c9e3cb3f2154b3bee656147fb2b631626250e9ae96665014c.exe
File type: pe · Size: 5633961 bytes
Verdict: malicious (99/100) · Family: Dmww

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (4 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller
Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dmww

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Yogi.1551 (rule Gen:Variant.Adware.Yogi.1551) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Sysn.dmww (rule Trojan-Dropper.Win32.Sysn.dmww) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 83 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

24712 behavior events · 2 ATT&CK techniques · 15 dropped files.

Runtime network

www.msftconnecttest.com
inference.location.live.net
t.me
telegram.org
cdn4.telesco.pe
edge-consumer-static.azureedge.net
1.0.240.10.in-addr.arpa.
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
252.0.0.224.in-addr.arpa.
wpad
ifconfig.me
go-ns.org.ua
tas02.sls.update.microsoft.com
v10.events.data.microsoft.com
ocsp.digicert.com
51.192.11.51.in-addr.arpa.
config.edge.skype.com
17.22.171.150.in-addr.arpa.

Dropped files

/opt/CAPEv2/storage/analyses/9016/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
/opt/CAPEv2/storage/analyses/9016/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
/opt/CAPEv2/storage/analyses/9016/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
/opt/CAPEv2/storage/analyses/9016/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
/opt/CAPEv2/storage/analyses/9016/files/cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af - cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af
/opt/CAPEv2/storage/analyses/9016/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
/opt/CAPEv2/storage/analyses/9016/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
/opt/CAPEv2/storage/analyses/9016/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
/opt/CAPEv2/storage/analyses/9016/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
/opt/CAPEv2/storage/analyses/9016/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
/opt/CAPEv2/storage/analyses/9016/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
/opt/CAPEv2/storage/analyses/9016/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
/opt/CAPEv2/storage/analyses/9016/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
/opt/CAPEv2/storage/analyses/9016/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
b53fb25a4f95610c06e8a91195ee7a588d226bbb854293c6867e2b7586253b56 - b53fb25a4f95610c06e8a91195ee7a588d226bbb854293c6867e2b7586253b56

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786379035&P2=404&P3=2&P4=Qlc9w1W7Dv88sdncpO%2bGpBCupb4AIQ%2b957j%2bqbHkKAIhWArASeDR%2fWLQAWmNXThQ7csWAlZ4RzoH864fxrRovQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786379107&P2=404&P3=2&P4=VhL6JIfUUcyBzbuZgIDNRS1sy7WbFPCUERjdDKnpGJ8jj%2b9BOD4r9CUttJcDV9NxdaDLavdMZmmBUH3YdSMPPw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
8.gq
ifconfig.me
go-ns.org.ua
t.me
www.tiktok.com
telegram.org
cdn4.telesco.pe

Embedded IP addresses

20.165.94.63
157.240.8.35
34.160.111.145
172.67.208.133
20.42.65.84
104.21.85.170
162.159.142.9
20.184.175.9
51.104.15.253
172.66.2.5
52.123.252.234
149.154.167.99
85.210.193.152
13.69.116.105
20.184.175.0
51.11.192.51
74.178.76.44
4.243.160.21
52.148.114.188
172.172.255.217
72.154.7.105
20.50.73.14
138.201.132.148
172.215.188.232
4.150.223.105

File paths

G:\($
Y:\bG
m:\0HCp

More Dmww samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report