Analysis
-
max time kernel
129s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-03-2021 07:45
Static task
static1
Behavioral task
behavioral1
Sample
yokingg.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
yokingg.bin.exe
Resource
win10v20201028
General
-
Target
yokingg.bin.exe
-
Size
206KB
-
MD5
2185400e57eccfe7a305caad403dcd37
-
SHA1
fc7b99e6f666784c804190b3a45563c153c83cb2
-
SHA256
0f5ed9c64792717b7c69940fc2e3db1a1b21515b506ab1de34da534012a5cac2
-
SHA512
eccce496638664f38e861008bb5c5cd63af8a8ac561e0f8fccb83a6047a6c53c9d7f2aaf8a38f7fca8da7c8dc48316de641659b9452eaa8ff36de6242f2fa33c
Malware Config
Extracted
C:\bootmgr.txt
Extracted
C:\BOOTNXT.txt
Extracted
C:\BOOTSECT.BAK.txt
Extracted
C:\vcredist2010_x64.log.html.txt
Extracted
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.txt
Extracted
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.txt
Extracted
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.txt
Extracted
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.txt
Extracted
C:\vcredist2019_x64_000_vcRuntimeMinimum_x64.log.txt
Extracted
C:\vcredist2019_x64_001_vcRuntimeAdditional_x64.log.txt
Extracted
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
pilote30
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops startup file 1 IoCs
Processes:
yokingg.bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\REZZZS.js yokingg.bin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
yokingg.bin.exedescription pid process Token: SeDebugPrivilege 1148 yokingg.bin.exe