5978884a07ea7559941ec2a1ce86e08e4be36a9aae9d535f58021602b24cdaba

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7
submitted
19/07/2020, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skynet_0.4.vir.exe
Size 3.6MB
Sample200719-fwck6e28f2
SHA256 5978884a07ea7559941ec2a1ce86e08e4be36a9aae9d535f58021602b24cdaba
MD5 a6cb3103fac2e6ad873ce6774e4ebddb
SHA1 37c20c2ed8556b27217264dbaa7aa5a96894ca23
SHA512 ef3f3fc6bd9764d4573250a43d2482483c5f2ddf4ba45218b4a2bb60b8d3a7992a36d7a9009db5d4818bb7601ea666963a16dafa56a09a47997d58627bda4058
MD5 SHA1 SHA512

Score

8^/10

upx persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{D0849AC1-6D54-5CEF-D5C6-4735842E799E} = "C:\\Users\\Admin\\AppData\\Roaming\\Mavi\\yrbit.exe"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	checkip.dyndns.org

Suspicious use of WriteProcessMemory 222 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 112 wrote to memory of 1612	112	skynet_0.4.vir.exe	24
PID 1612 wrote to memory of 744	1612	skynet_0.4.vir.exe	25
PID 1612 wrote to memory of 744	1612	skynet_0.4.vir.exe	25
PID 1612 wrote to memory of 744	1612	skynet_0.4.vir.exe	25
PID 1612 wrote to memory of 744	1612	skynet_0.4.vir.exe	25
PID 1612 wrote to memory of 928	1612	skynet_0.4.vir.exe	26
PID 1612 wrote to memory of 928	1612	skynet_0.4.vir.exe	26
PID 1612 wrote to memory of 928	1612	skynet_0.4.vir.exe	26
PID 1612 wrote to memory of 928	1612	skynet_0.4.vir.exe	26
PID 1612 wrote to memory of 1064	1612	skynet_0.4.vir.exe	27
PID 1612 wrote to memory of 1064	1612	skynet_0.4.vir.exe	27
PID 1612 wrote to memory of 1064	1612	skynet_0.4.vir.exe	27
PID 1612 wrote to memory of 1064	1612	skynet_0.4.vir.exe	27
PID 1612 wrote to memory of 1092	1612	skynet_0.4.vir.exe	28
PID 1612 wrote to memory of 1092	1612	skynet_0.4.vir.exe	28
PID 1612 wrote to memory of 1092	1612	skynet_0.4.vir.exe	28
PID 1612 wrote to memory of 1092	1612	skynet_0.4.vir.exe	28
PID 1612 wrote to memory of 1088	1612	skynet_0.4.vir.exe	29
PID 1612 wrote to memory of 1088	1612	skynet_0.4.vir.exe	29
PID 1612 wrote to memory of 1088	1612	skynet_0.4.vir.exe	29
PID 1612 wrote to memory of 1088	1612	skynet_0.4.vir.exe	29
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1612 wrote to memory of 1072	1612	skynet_0.4.vir.exe	30
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1072 wrote to memory of 1932	1072	svchost.exe	33
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1956	1932	svchost.exe	34
PID 1932 wrote to memory of 1820	1932	svchost.exe	35
PID 1932 wrote to memory of 1820	1932	svchost.exe	35
PID 1932 wrote to memory of 1820	1932	svchost.exe	35
PID 1932 wrote to memory of 1820	1932	svchost.exe	35
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1932 wrote to memory of 1772	1932	svchost.exe	36
PID 1956 wrote to memory of 1156	1956	svchost.exe	38
PID 1956 wrote to memory of 1156	1956	svchost.exe	38
PID 1956 wrote to memory of 1156	1956	svchost.exe	38
PID 1956 wrote to memory of 1156	1956	svchost.exe	38
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1156 wrote to memory of 1172	1156	yrbit.exe	41
PID 1956 wrote to memory of 1480	1956	svchost.exe	42
PID 1956 wrote to memory of 1480	1956	svchost.exe	42
PID 1956 wrote to memory of 1480	1956	svchost.exe	42
PID 1956 wrote to memory of 1480	1956	svchost.exe	42
PID 1172 wrote to memory of 1420	1172	yrbit.exe	44
PID 1172 wrote to memory of 1420	1172	yrbit.exe	44
PID 1172 wrote to memory of 1420	1172	yrbit.exe	44
PID 1172 wrote to memory of 1420	1172	yrbit.exe	44
PID 1172 wrote to memory of 1428	1172	yrbit.exe	45
PID 1172 wrote to memory of 1428	1172	yrbit.exe	45
PID 1172 wrote to memory of 1428	1172	yrbit.exe	45
PID 1172 wrote to memory of 1428	1172	yrbit.exe	45
PID 1172 wrote to memory of 1492	1172	yrbit.exe	46
PID 1172 wrote to memory of 1492	1172	yrbit.exe	46
PID 1172 wrote to memory of 1492	1172	yrbit.exe	46
PID 1172 wrote to memory of 1492	1172	yrbit.exe	46
PID 1172 wrote to memory of 1564	1172	yrbit.exe	47
PID 1172 wrote to memory of 1564	1172	yrbit.exe	47
PID 1172 wrote to memory of 1564	1172	yrbit.exe	47
PID 1172 wrote to memory of 1564	1172	yrbit.exe	47
PID 1172 wrote to memory of 1476	1172	yrbit.exe	48
PID 1172 wrote to memory of 1476	1172	yrbit.exe	48
PID 1172 wrote to memory of 1476	1172	yrbit.exe	48
PID 1172 wrote to memory of 1476	1172	yrbit.exe	48
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 1172 wrote to memory of 652	1172	yrbit.exe	49
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 652 wrote to memory of 748	652	svchost.exe	50
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 748 wrote to memory of 572	748	svchost.exe	51
PID 572 wrote to memory of 1180	572	svchost.exe	18
PID 572 wrote to memory of 1180	572	svchost.exe	18
PID 572 wrote to memory of 1180	572	svchost.exe	18
PID 572 wrote to memory of 1180	572	svchost.exe	18
PID 572 wrote to memory of 1180	572	svchost.exe	18
PID 572 wrote to memory of 1256	572	svchost.exe	19
PID 572 wrote to memory of 1256	572	svchost.exe	19
PID 572 wrote to memory of 1256	572	svchost.exe	19
PID 572 wrote to memory of 1256	572	svchost.exe	19
PID 572 wrote to memory of 1256	572	svchost.exe	19
PID 572 wrote to memory of 1300	572	svchost.exe	20
PID 572 wrote to memory of 1300	572	svchost.exe	20
PID 572 wrote to memory of 1300	572	svchost.exe	20
PID 572 wrote to memory of 1300	572	svchost.exe	20
PID 572 wrote to memory of 1300	572	svchost.exe	20
PID 572 wrote to memory of 1932	572	svchost.exe	33
PID 572 wrote to memory of 1932	572	svchost.exe	33
PID 572 wrote to memory of 1932	572	svchost.exe	33
PID 572 wrote to memory of 1932	572	svchost.exe	33
PID 572 wrote to memory of 1932	572	svchost.exe	33
PID 572 wrote to memory of 2004	572	svchost.exe	40
PID 572 wrote to memory of 2004	572	svchost.exe	40
PID 572 wrote to memory of 2004	572	svchost.exe	40
PID 572 wrote to memory of 2004	572	svchost.exe	40
PID 572 wrote to memory of 2004	572	svchost.exe	40
PID 572 wrote to memory of 748	572	svchost.exe	50
PID 572 wrote to memory of 748	572	svchost.exe	50
PID 572 wrote to memory of 748	572	svchost.exe	50
PID 572 wrote to memory of 748	572	svchost.exe	50
PID 572 wrote to memory of 748	572	svchost.exe	50
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1328	748	svchost.exe	53
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 1792	748	svchost.exe	54
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 748 wrote to memory of 2028	748	svchost.exe	56
PID 572 wrote to memory of 920	572	svchost.exe	52
PID 572 wrote to memory of 920	572	svchost.exe	52
PID 572 wrote to memory of 920	572	svchost.exe	52
PID 572 wrote to memory of 920	572	svchost.exe	52
PID 572 wrote to memory of 920	572	svchost.exe	52
PID 572 wrote to memory of 1744	572	svchost.exe	57
PID 572 wrote to memory of 1744	572	svchost.exe	57
PID 572 wrote to memory of 1744	572	svchost.exe	57
PID 572 wrote to memory of 1744	572	svchost.exe	57
PID 572 wrote to memory of 1744	572	svchost.exe	57
PID 572 wrote to memory of 1688	572	svchost.exe	58
PID 572 wrote to memory of 1688	572	svchost.exe	58
PID 572 wrote to memory of 1688	572	svchost.exe	58
PID 572 wrote to memory of 1688	572	svchost.exe	58
PID 572 wrote to memory of 1688	572	svchost.exe	58

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1956	svchost.exe
Token: SeSecurityPrivilege	1932	svchost.exe
Token: SeSecurityPrivilege	1932	svchost.exe
Token: SeSecurityPrivilege	748	svchost.exe
Token: SeSecurityPrivilege	748	svchost.exe
Token: SeManageVolumePrivilege	920	WinMail.exe

Loads dropped DLL 2 IoCs

pid	Process
1956	svchost.exe
1956	svchost.exe

Deletes itself 1 IoCs

pid	Process
1480	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	svchost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\239D5DA7-00000001.eml:OECustomProperty	WinMail.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 112 set thread context of 1612	112	skynet_0.4.vir.exe	24
PID 1612 set thread context of 1072	1612	skynet_0.4.vir.exe	30
PID 1072 set thread context of 1932	1072	svchost.exe	33
PID 1932 set thread context of 1956	1932	svchost.exe	34
PID 1932 set thread context of 1772	1932	svchost.exe	36
PID 1156 set thread context of 1172	1156	yrbit.exe	41
PID 1172 set thread context of 652	1172	yrbit.exe	49
PID 652 set thread context of 748	652	svchost.exe	50
PID 748 set thread context of 572	748	svchost.exe	51
PID 748 set thread context of 1792	748	svchost.exe	54
PID 748 set thread context of 1792	748	svchost.exe	54
PID 748 set thread context of 2028	748	svchost.exe	56
PID 748 set thread context of 2028	748	svchost.exe	56

Suspicious behavior: EnumeratesProcesses 76 IoCs

pid	Process
1772	svchost.exe
1772	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
1932	svchost.exe
572	svchost.exe
1932	svchost.exe
1792	svchost.exe
748	svchost.exe
748	svchost.exe
2028	svchost.exe
572	svchost.exe
572	svchost.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
572	svchost.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
1156	yrbit.exe
1172	yrbit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
920	WinMail.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1772-12-0x0000000000400000-0x0000000000742000-memory.dmp	upx
behavioral1/memory/1772-14-0x0000000000400000-0x0000000000742000-memory.dmp	upx
behavioral1/memory/1772-15-0x0000000000400000-0x0000000000742000-memory.dmp	upx

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1180

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1256

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1300
- C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:112
- - C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe
    "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of SetThreadContext
    PID:1612
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
      4⤵
      PID:744
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
      4⤵
      PID:928
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
      4⤵
      PID:1064
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
      4⤵
      PID:1092
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious use of SetThreadContext
      PID:1072
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\SysWOW64\svchost.exe" "ext" "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        Suspicious use of AdjustPrivilegeToken
        Modifies Internet Explorer settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1932
      - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\system32\svchost.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        Loads dropped DLL
        
        PID:1956
        
        C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe
        
        "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        7⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        
        PID:1156
        
        C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe
        
        "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        8⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        
        PID:1172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        9⤵
        
        PID:1420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        9⤵
        
        PID:1428
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        9⤵
        
        PID:1492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        9⤵
        
        PID:1564
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        9⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\system32\svchost.exe" ext "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        9⤵
        Suspicious use of SetThreadContext
        
        PID:652
        
        C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\SysWOW64\svchost.exe" "ext" "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        10⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:748
        
        C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\system32\svchost.exe" ext "C:\Users\Admin\AppData\Roaming\Mavi\yrbit.exe"
        11⤵
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
        11⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\svchost.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1792
        
        C:\Windows\SysWOW64\svchost.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
        11⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb68293aa.bat"
        7⤵
        Deletes itself
        
        PID:1480
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
        6⤵
        
        PID:1820
      - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1772

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2004

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-846586291-98078367317426278481563209976-904717663681215543-8748100671462632232"
1⤵
PID:1744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-424-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/652-416-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/652-418-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/920-683-0x0000000003E00000-0x0000000003E02000-memory.dmp

Download

memory/920-428-0x0000000003770000-0x0000000003970000-memory.dmp

Download

memory/920-677-0x0000000003DE0000-0x0000000003DE2000-memory.dmp

Download

memory/920-678-0x0000000003E40000-0x0000000003E42000-memory.dmp

Download

memory/920-438-0x0000000003660000-0x0000000003662000-memory.dmp

Download

memory/920-679-0x0000000003E00000-0x0000000003E02000-memory.dmp

Download

memory/920-680-0x00000000036D0000-0x00000000036D2000-memory.dmp

Download

memory/920-433-0x0000000003870000-0x0000000003970000-memory.dmp

Download

memory/920-681-0x0000000003DF0000-0x0000000003DF2000-memory.dmp

Download

memory/920-675-0x0000000003660000-0x0000000003662000-memory.dmp

Download

memory/920-682-0x0000000003660000-0x0000000003662000-memory.dmp

Download

memory/920-430-0x0000000003770000-0x0000000003870000-memory.dmp

Download

memory/920-676-0x0000000003DE0000-0x0000000003DE2000-memory.dmp

Download

memory/920-432-0x0000000003770000-0x0000000003970000-memory.dmp

Download

memory/920-426-0x0000000003770000-0x0000000003870000-memory.dmp

Download

memory/920-439-0x0000000003670000-0x0000000003672000-memory.dmp

Download

memory/920-440-0x0000000003650000-0x0000000003652000-memory.dmp

Download

memory/1072-3-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/1072-5-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/1612-2-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1612-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1772-19-0x0000000002B10000-0x0000000002B21000-memory.dmp

Download

memory/1772-17-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download

memory/1772-12-0x0000000000400000-0x0000000000742000-memory.dmp

Download

memory/1772-243-0x0000000002B10000-0x0000000002B21000-memory.dmp

Download

memory/1772-242-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download

memory/1772-14-0x0000000000400000-0x0000000000742000-memory.dmp

Download

memory/1772-15-0x0000000000400000-0x0000000000742000-memory.dmp

Download

memory/1772-16-0x0000000002B10000-0x0000000002B21000-memory.dmp

Download

memory/1772-241-0x0000000002B10000-0x0000000002B21000-memory.dmp

Download

memory/1772-18-0x0000000002B10000-0x0000000002B21000-memory.dmp

Download

memory/1792-449-0x00000000030C0000-0x00000000030D1000-memory.dmp

Download

memory/1792-450-0x0000000002CB0000-0x0000000002CC1000-memory.dmp

Download

memory/1792-448-0x0000000002CB0000-0x0000000002CC1000-memory.dmp

Download

memory/1792-441-0x0000000000050000-0x0000000000077000-memory.dmp

Download

memory/1956-9-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/1956-11-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/2028-689-0x0000000002B30000-0x0000000002B41000-memory.dmp

Download

memory/2028-690-0x0000000002F40000-0x0000000002F51000-memory.dmp

Download

memory/2028-691-0x0000000002B30000-0x0000000002B41000-memory.dmp

Download