Analysis
- max time kernel
151s - max time network
132s - platform
windows7_x64 - resource
win7v200430 - submitted
19/07/2020, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
tasks_198.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tasks_198.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target tasks_198.vir.exe
- Size 228KB
- Sample200719-dldkx3tsya
- SHA256 342425bd5a785ef2b41caed40e935f8d02a6c63473f6ac997022372989e9f070
- MD5 2ef3920dfb2f9c06abba966bac26bd19
- SHA1 c6a545b0b6efb7453d7b23098d4a604d513cfd57
- SHA512 8f55d6162e4351834f8abcf46209e7edda7ab8d5ddd327aeb008212d3310b83348847257d9ec62c16bc40698738812351f322817ab48037eee17553161efdd5b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winsec32.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ybdew.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Biuzfari = "\"C:\\Users\\Admin\\AppData\\Roaming\\Yttetivu\\ybdew.exe\"" Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Biuzfari = "\"C:\\Users\\Admin\\AppData\\Roaming\\Yttetivu\\ybdew.exe\"" winsec32.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Biuzfari = "C:\\Users\\Admin\\AppData\\Roaming\\Yttetivu\\ybdew.exe" ybdew.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ybdew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Biuzfari = "C:\\Users\\Admin\\AppData\\Roaming\\Yttetivu\\ybdew.exe" ybdew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Biuzfari = "\"C:\\Users\\Admin\\AppData\\Roaming\\Yttetivu\\ybdew.exe\"" Explorer.EXE - Executes dropped EXE 3 IoCs
pid Process 112 winsec32.exe 764 ybdew.exe 1540 ybdew.exe - Loads dropped DLL 1 IoCs
pid Process 1520 tasks_198.vir.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1520 wrote to memory of 764 1520 tasks_198.vir.exe 25 PID 1520 wrote to memory of 764 1520 tasks_198.vir.exe 25 PID 1520 wrote to memory of 764 1520 tasks_198.vir.exe 25 PID 1520 wrote to memory of 764 1520 tasks_198.vir.exe 25 PID 764 wrote to memory of 1236 764 ybdew.exe 20 PID 764 wrote to memory of 1540 764 ybdew.exe 26 PID 764 wrote to memory of 1540 764 ybdew.exe 26 PID 764 wrote to memory of 1540 764 ybdew.exe 26 PID 764 wrote to memory of 1540 764 ybdew.exe 26 PID 764 wrote to memory of 1236 764 ybdew.exe 20 PID 764 wrote to memory of 1236 764 ybdew.exe 20 PID 764 wrote to memory of 1236 764 ybdew.exe 20 PID 764 wrote to memory of 1236 764 ybdew.exe 20 PID 1520 wrote to memory of 1688 1520 tasks_198.vir.exe 27 PID 1520 wrote to memory of 1688 1520 tasks_198.vir.exe 27 PID 1520 wrote to memory of 1688 1520 tasks_198.vir.exe 27 PID 1520 wrote to memory of 1688 1520 tasks_198.vir.exe 27 PID 764 wrote to memory of 1236 764 ybdew.exe 20 PID 764 wrote to memory of 1236 764 ybdew.exe 20 PID 1540 wrote to memory of 1844 1540 ybdew.exe 29 PID 1540 wrote to memory of 1844 1540 ybdew.exe 29 PID 1540 wrote to memory of 1844 1540 ybdew.exe 29 PID 1540 wrote to memory of 1844 1540 ybdew.exe 29 - Suspicious behavior: EnumeratesProcesses 90 IoCs
pid Process 764 ybdew.exe 764 ybdew.exe 764 ybdew.exe 764 ybdew.exe 764 ybdew.exe 764 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe 1540 ybdew.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1540 ybdew.exe 1540 ybdew.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Security Center Update - 3234520226.job tasks_198.vir.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\winsec32.exe tasks_198.vir.exe File opened for modification C:\Windows\SysWOW64\winsec32.exe tasks_198.vir.exe - Deletes itself 1 IoCs
pid Process 1688 cmd.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main ybdew.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\tasks_198.vir.exe"C:\Users\Admin\AppData\Local\Temp\tasks_198.vir.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Drops file in Windows directory
- Drops file in System32 directory
PID:1520 -
C:\Users\Admin\AppData\Roaming\Yttetivu\ybdew.exe"C:\Users\Admin\AppData\Roaming\Yttetivu\ybdew.exe"3⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:764 -
C:\Users\Admin\AppData\Roaming\Yttetivu\ybdew.exe"C:\Users\Admin\AppData\Roaming\Yttetivu\ybdew.exe" -child4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
PID:1540 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe5⤵PID:1844
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp8474b074.bat"3⤵
- Deletes itself
PID:1688
-
-
-
C:\Windows\SysWOW64\winsec32.exe"C:\Windows\SysWOW64\winsec32.exe" -service "C:\Users\Admin\AppData\Roaming\Yttetivu\ybdew.exe"1⤵
- Adds Run key to start application
- Executes dropped EXE
PID:112