General

  • Target

    iym.exe

  • Size

    20KB

  • Sample

    210120-l3sdyfepdn

  • MD5

    9d1c8d505aed4eb37bd5530a0b5b3b10

  • SHA1

    8727180dafb631c287957dedbcc4f989fb0a5825

  • SHA256

    1730e8fd738a26adbe3f0b31192adf6d4cc175f021b2d06e6278e36a43efef40

  • SHA512

    0a1776064a7a82a53881036ed2b3ab9a30f0c842c826543202cbf6399cb10f6ca2544e95672e87ab59c84d5778544aa89dfaa802ab843aa57bf6bcbeb4f27bea

Malware Config

Targets

    • Target

      iym.exe

    • Size

      20KB

    • MD5

      9d1c8d505aed4eb37bd5530a0b5b3b10

    • SHA1

      8727180dafb631c287957dedbcc4f989fb0a5825

    • SHA256

      1730e8fd738a26adbe3f0b31192adf6d4cc175f021b2d06e6278e36a43efef40

    • SHA512

      0a1776064a7a82a53881036ed2b3ab9a30f0c842c826543202cbf6399cb10f6ca2544e95672e87ab59c84d5778544aa89dfaa802ab843aa57bf6bcbeb4f27bea

    • Modifies WinLogon for persistence

    • Modifies Windows Defender Real-time Protection settings

    • Turns off Windows Defender SpyNet reporting

    • Windows security bypass

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Windows security modification

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

4
T1089

Virtualization/Sandbox Evasion

2
T1497

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Command and Control

Web Service

1
T1102

Tasks