40e20cc321623df3271e2ea7cbe75f647096a8a30737d21d0ef8ddbdc33a7f49

General

Target
Yceuqvs.exe
Size 924KB
Sample200626-27a59cdq6j
SHA256 40e20cc321623df3271e2ea7cbe75f647096a8a30737d21d0ef8ddbdc33a7f49
MD5 97f87622e4196909824e884ee7d7c0ae
SHA1 99ee116f87627709feee36edd6f6f4043beb2f08
SHA512 4844b3058d2b871e1f490f4d7a43ea88933922f19c881968aa25cc4ca706c70ed8847be107471bd51d5cdd5766a53ad7ca0d143f93ab2d136a97387e5eb7108d
MD5 SHA1 SHA512

Score

7^/10

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1152 wrote to memory of 1916	1152	Yceuqvs.exe	26
PID 1224 wrote to memory of 1972	1224	Explorer.EXE	27
PID 1224 wrote to memory of 1972	1224	Explorer.EXE	27
PID 1224 wrote to memory of 1972	1224	Explorer.EXE	27
PID 1224 wrote to memory of 1972	1224	Explorer.EXE	27
PID 1972 wrote to memory of 1128	1972	ipconfig.exe	28
PID 1972 wrote to memory of 1128	1972	ipconfig.exe	28
PID 1972 wrote to memory of 1128	1972	ipconfig.exe	28
PID 1972 wrote to memory of 1128	1972	ipconfig.exe	28
PID 1972 wrote to memory of 1128	1972	ipconfig.exe	28

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious behavior: MapViewOfSection 7 IoCs

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 1224	1916	ieinstal.exe	20
PID 1972 set thread context of 1224	1972	ipconfig.exe	20

Suspicious use of FindShellTrayWindow 5 IoCs

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	ieinstal.exe
Token: SeDebugPrivilege	1972	ipconfig.exe

Suspicious use of SendNotifyMessage 4 IoCs

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Yceu = "C:\\Users\\Admin\\AppData\\Local\\Yceu\\Yceu.hta"	Yceuqvs.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102