46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
145s
max time network
170s
platform
windows10_x64
resource
win10
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/04884a82d01d733f245d921e1f74fb1b.exe

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

YiwanLoader.exe

pid process

3056 YiwanLoader.exe

pid	process
3056	YiwanLoader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

04884a82d01d733f245d921e1f74fb1b.exeYiwanLoader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	04884a82d01d733f245d921e1f74fb1b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YiwanLoader.exe

Loads dropped DLL 10 IoCs

Processes:

04884a82d01d733f245d921e1f74fb1b.exeYiwanLoader.exe

pid	process
3360	04884a82d01d733f245d921e1f74fb1b.exe
3360	04884a82d01d733f245d921e1f74fb1b.exe
3360	04884a82d01d733f245d921e1f74fb1b.exe
3360	04884a82d01d733f245d921e1f74fb1b.exe
3360	04884a82d01d733f245d921e1f74fb1b.exe
3056	YiwanLoader.exe
3056	YiwanLoader.exe
3056	YiwanLoader.exe
3056	YiwanLoader.exe
3056	YiwanLoader.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

04884a82d01d733f245d921e1f74fb1b.exe

description ioc process

File opened for modification \??\PhysicalDrive0 04884a82d01d733f245d921e1f74fb1b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	04884a82d01d733f245d921e1f74fb1b.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

04884a82d01d733f245d921e1f74fb1b.exeYiwanLoader.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	04884a82d01d733f245d921e1f74fb1b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	04884a82d01d733f245d921e1f74fb1b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	YiwanLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	YiwanLoader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

YiwanLoader.exe

pid process

3056 YiwanLoader.exe
3056 YiwanLoader.exe

pid	process
3056	YiwanLoader.exe
3056	YiwanLoader.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

04884a82d01d733f245d921e1f74fb1b.exeYiwanLoader.exe

description	pid	process
Token: SeManageVolumePrivilege	3360	04884a82d01d733f245d921e1f74fb1b.exe
Token: SeManageVolumePrivilege	3360	04884a82d01d733f245d921e1f74fb1b.exe
Token: SeDebugPrivilege	3056	YiwanLoader.exe
Token: SeManageVolumePrivilege	3056	YiwanLoader.exe
Token: SeManageVolumePrivilege	3056	YiwanLoader.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

YiwanLoader.exe

pid process

3056 YiwanLoader.exe
3056 YiwanLoader.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

YiwanLoader.exe

pid process

3056 YiwanLoader.exe
3056 YiwanLoader.exe

pid	process
3056	YiwanLoader.exe
3056	YiwanLoader.exe

pid	process
3056	YiwanLoader.exe
3056	YiwanLoader.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

04884a82d01d733f245d921e1f74fb1b.exe

description	pid	process	target process
PID 3360 wrote to memory of 3056	3360	04884a82d01d733f245d921e1f74fb1b.exe	YiwanLoader.exe
PID 3360 wrote to memory of 3056	3360	04884a82d01d733f245d921e1f74fb1b.exe	YiwanLoader.exe
PID 3360 wrote to memory of 3056	3360	04884a82d01d733f245d921e1f74fb1b.exe	YiwanLoader.exe

C:\Users\Admin\AppData\Local\Temp\foo\04884a82d01d733f245d921e1f74fb1b.exe
"C:\Users\Admin\AppData\Local\Temp\foo\04884a82d01d733f245d921e1f74fb1b.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Roaming\yiwanzhushou\YiwanLoader.exe
  "C:\Users\Admin\AppData\Roaming\yiwanzhushou\YiwanLoader.exe" --cno 360mnq_01_771431
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\yiwanzhushou\YiwanLoader.exe

MD5
64ce3386fb51089c22d82a106a3354fe

SHA1
5f920096b8ab95cb524912acdfe44a4ffcd067be

SHA256
8cd71028349f830c5646380627d0ba1b31d91520b48038f06eaf7792f763f488

SHA512
ab45e76debf7ac78b079b63c8e0db3743ad03df9d9f64e3014e55ca8f954a90f81daa57bde6ea2dec997ad90a51ca9a097f6ab016f9ae103dcc2f368ed9174fa

Download Submit
C:\Users\Admin\AppData\Roaming\yiwanzhushou\YiwanLoader.exe

MD5
64ce3386fb51089c22d82a106a3354fe

SHA1
5f920096b8ab95cb524912acdfe44a4ffcd067be

SHA256
8cd71028349f830c5646380627d0ba1b31d91520b48038f06eaf7792f763f488

SHA512
ab45e76debf7ac78b079b63c8e0db3743ad03df9d9f64e3014e55ca8f954a90f81daa57bde6ea2dec997ad90a51ca9a097f6ab016f9ae103dcc2f368ed9174fa

Download Submit
C:\Users\Admin\AppData\Roaming\yiwanzhushou\yiwanadapt.ini

MD5
8389ca1598eb613734432e8d32cba421

SHA1
2f2e5e77bf17dd8a56aaebcf0afd0744c004dcb4

SHA256
7bfb596b8638007af552d27ba2ebae41ef236e0f22bb16a9782d19185cdba574

SHA512
e67d19427d0cf6a0bcb7ba2ca493fa182942fca9bdac42918d9dbc9822ddfd38c835d41687d564136ea4294ed3546f2cca01aae031f0ba4c2515069b5f179434

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\pdown\360NetBase.dll

MD5
d4eb336206cbdcb08518cb11665d376b

SHA1
7d3fa08c4389d46835f3e51e9c4ac9f27b25d082

SHA256
f548931cd2c1bd50889b673642934dc9b215f2a53eeba75e2491b072b26a2f0c

SHA512
a5d27b582cb003af83e86268b226004cd72d1bd3a2312edb2232a6ecc1dedd6bf3c44230e7632d599db3a71f2e10715250fdcb4ef3073b3291b78c4b3cd3d2f8

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\pdown\360P2SP.dll

MD5
b5380239ddd11f893f5fbd1f5811d11a

SHA1
07b48d972443cccd31d5b41c54aa8c04e31698a0

SHA256
7f67afe3068f68fc1ad4649b86b4f2a03610670a37ba74f13511a36f4114b7ce

SHA512
8390c6c06a4ef929b57fd23a6432243205cddc8c092e3962108ac5624fa870a80d49a4ff55303748cae1e8e2f451d688e3f25438266a27b5b3d83912662ad031

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\pdown\360net.dll

MD5
f7831f4ab3ec71dd7d8868599ebda730

SHA1
d06f0c3382a2de2dcf534cbce6d25fe7cf35d1a1

SHA256
55ca778d8f7cb71c439b3e6d08867c5770fab544d7b7835117ffccb5acddb6eb

SHA512
5b660a534c30c7a0c92b59fee5a31866c77ea1a82bf2e2129b4fabc7e245413bb3e310c5a0827986aee473d629b07cdab2e03cddd949102f98b850a8428fcd2b

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\pdown\LiveUpd360.dll

MD5
335974b59e70b7460af46995caac1d1a

SHA1
6915724067b2aa7adf009abdfb5afb75da1b469d

SHA256
ee69d98ab8139873a17bf5cdaed50b3153c86d993f515179c4ffdbcedc3f7a21

SHA512
17b968a204cad7c146e6b4b819ea4723544f01956e880a0587d33576595fe7ef17447f58d994db184038320a36f4decb0aa54226486b3661f6f158202ad3639d

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\pdown\PDown.dll

MD5
2ff3bd91df34ee0681da46b3efe43575

SHA1
b92df173eeb4db28e0904a8decde6f6c20b57e73

SHA256
2306df70d574ba09a3bc1d6a66c6cbd6003ad37585da5fd99c00672b3ec49737

SHA512
602e4d258afdb0b7c531ed94ec676bf4653bc2abfbc255b302172fbb6236e23508720b1a8b097bc29af9c5fc26a8788c0474c78be5785510cb8840b99f646915

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\temp\pdown\360NetBase.dll

MD5
d4eb336206cbdcb08518cb11665d376b

SHA1
7d3fa08c4389d46835f3e51e9c4ac9f27b25d082

SHA256
f548931cd2c1bd50889b673642934dc9b215f2a53eeba75e2491b072b26a2f0c

SHA512
a5d27b582cb003af83e86268b226004cd72d1bd3a2312edb2232a6ecc1dedd6bf3c44230e7632d599db3a71f2e10715250fdcb4ef3073b3291b78c4b3cd3d2f8

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\temp\pdown\360P2SP.dll

MD5
b5380239ddd11f893f5fbd1f5811d11a

SHA1
07b48d972443cccd31d5b41c54aa8c04e31698a0

SHA256
7f67afe3068f68fc1ad4649b86b4f2a03610670a37ba74f13511a36f4114b7ce

SHA512
8390c6c06a4ef929b57fd23a6432243205cddc8c092e3962108ac5624fa870a80d49a4ff55303748cae1e8e2f451d688e3f25438266a27b5b3d83912662ad031

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\temp\pdown\360net.dll

MD5
f7831f4ab3ec71dd7d8868599ebda730

SHA1
d06f0c3382a2de2dcf534cbce6d25fe7cf35d1a1

SHA256
55ca778d8f7cb71c439b3e6d08867c5770fab544d7b7835117ffccb5acddb6eb

SHA512
5b660a534c30c7a0c92b59fee5a31866c77ea1a82bf2e2129b4fabc7e245413bb3e310c5a0827986aee473d629b07cdab2e03cddd949102f98b850a8428fcd2b

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\temp\pdown\LiveUpd360.dll

MD5
335974b59e70b7460af46995caac1d1a

SHA1
6915724067b2aa7adf009abdfb5afb75da1b469d

SHA256
ee69d98ab8139873a17bf5cdaed50b3153c86d993f515179c4ffdbcedc3f7a21

SHA512
17b968a204cad7c146e6b4b819ea4723544f01956e880a0587d33576595fe7ef17447f58d994db184038320a36f4decb0aa54226486b3661f6f158202ad3639d

Download Submit
\Users\Admin\AppData\Roaming\yiwanzhushou\temp\pdown\PDown.dll

MD5
2ff3bd91df34ee0681da46b3efe43575

SHA1
b92df173eeb4db28e0904a8decde6f6c20b57e73

SHA256
2306df70d574ba09a3bc1d6a66c6cbd6003ad37585da5fd99c00672b3ec49737

SHA512
602e4d258afdb0b7c531ed94ec676bf4653bc2abfbc255b302172fbb6236e23508720b1a8b097bc29af9c5fc26a8788c0474c78be5785510cb8840b99f646915

Download Submit
memory/3056-5-0x0000000000000000-mapping.dmp

Download