Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-03-2021 14:45
Static task
static1
Behavioral task
behavioral1
Sample
yokingg.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
yokingg.exe
Resource
win10v20201028
General
-
Target
yokingg.exe
-
Size
261KB
-
MD5
4de76198ea4488eae192d0ca4e4bd66b
-
SHA1
5ac5585b13ea356969b168b86df12053a6de4ee2
-
SHA256
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302
-
SHA512
db6c2ebbd9d01ebf8af3e68ef8e938c7b6da2c0eef5fc22f63fe69665c56ec19c2d241558984e03afb116b98a4e7dc2b0f4aa8dadd90f44caf3f72ae5f2ee52f
Malware Config
Extracted
C:\vcredist2010_x64.log.html.txt
Extracted
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.txt
Extracted
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.txt
Extracted
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.txt
Extracted
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.txt
Extracted
C:\vcredist2019_x64_001_vcRuntimeMinimum_x64.log.txt
Extracted
C:\vcredist2019_x64_002_vcRuntimeAdditional_x64.log.txt
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.txt
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.txt
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe.txt
Extracted
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
pilote30
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops startup file 1 IoCs
Processes:
yokingg.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\REZZZS.js yokingg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
yokingg.exeyokingg.exedescription pid process Token: SeDebugPrivilege 844 yokingg.exe Token: SeDebugPrivilege 836 yokingg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
yokingg.exedescription pid process target process PID 844 wrote to memory of 836 844 yokingg.exe yokingg.exe PID 844 wrote to memory of 836 844 yokingg.exe yokingg.exe PID 844 wrote to memory of 836 844 yokingg.exe yokingg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\yokingg.exe"C:\Users\Admin\AppData\Local\Temp\yokingg.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\yokingg.exe"C:\Users\Admin\AppData\Local\Temp\yokingg.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:836