Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 03:41
Static task
static1
Behavioral task
behavioral1
Sample
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe
Resource
win10v20210410
General
-
Target
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe
-
Size
123KB
-
MD5
4f0abd7211e5bcb49a92591158d4d231
-
SHA1
f8e6d9646bf17d37f2aad9f5b82212f90f67b886
-
SHA256
b11f8065c37558a54799f1965283968f05754cd63328560148f59d54ed77351c
-
SHA512
3e5369dfd10eee1c0f456cd7aa94e095d289f9895f67046df25cac5294b7d6dde897fdc59425c8cd75c61ef6285ef5b645bc7a5f2d5de6b7f6a174bac70ee8fc
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ysdanei.exeysdanei.exepid process 1636 ysdanei.exe 472 ysdanei.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 336 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exepid process 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ysdanei.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\Currentversion\Run ysdanei.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B2AE30F8-6AC7-80A3-89B7-D63D73CDA968} = "C:\\Users\\Admin\\AppData\\Roaming\\Yqibsy\\ysdanei.exe" ysdanei.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exeysdanei.exedescription pid process target process PID 1796 set thread context of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1636 set thread context of 472 1636 ysdanei.exe ysdanei.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ysdanei.exepid process 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe 472 ysdanei.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exedescription pid process Token: SeSecurityPrivilege 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exef8e6d9646bf17d37f2aad9f5b82212f90f67b886.exeysdanei.execmd.exeysdanei.exedescription pid process target process PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1796 wrote to memory of 1804 1796 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 1804 wrote to memory of 1464 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 1804 wrote to memory of 1464 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 1804 wrote to memory of 1464 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 1804 wrote to memory of 1464 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 1804 wrote to memory of 1636 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe ysdanei.exe PID 1804 wrote to memory of 1636 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe ysdanei.exe PID 1804 wrote to memory of 1636 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe ysdanei.exe PID 1804 wrote to memory of 1636 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1636 wrote to memory of 472 1636 ysdanei.exe ysdanei.exe PID 1464 wrote to memory of 1056 1464 cmd.exe netsh.exe PID 1464 wrote to memory of 1056 1464 cmd.exe netsh.exe PID 1464 wrote to memory of 1056 1464 cmd.exe netsh.exe PID 1464 wrote to memory of 1056 1464 cmd.exe netsh.exe PID 1804 wrote to memory of 336 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 1804 wrote to memory of 336 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 1804 wrote to memory of 336 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 1804 wrote to memory of 336 1804 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe cmd.exe PID 472 wrote to memory of 1116 472 ysdanei.exe taskhost.exe PID 472 wrote to memory of 1116 472 ysdanei.exe taskhost.exe PID 472 wrote to memory of 1116 472 ysdanei.exe taskhost.exe PID 472 wrote to memory of 1116 472 ysdanei.exe taskhost.exe PID 472 wrote to memory of 1116 472 ysdanei.exe taskhost.exe PID 472 wrote to memory of 1168 472 ysdanei.exe Dwm.exe PID 472 wrote to memory of 1168 472 ysdanei.exe Dwm.exe PID 472 wrote to memory of 1168 472 ysdanei.exe Dwm.exe PID 472 wrote to memory of 1168 472 ysdanei.exe Dwm.exe PID 472 wrote to memory of 1168 472 ysdanei.exe Dwm.exe PID 472 wrote to memory of 1212 472 ysdanei.exe Explorer.EXE PID 472 wrote to memory of 1212 472 ysdanei.exe Explorer.EXE PID 472 wrote to memory of 1212 472 ysdanei.exe Explorer.EXE PID 472 wrote to memory of 1212 472 ysdanei.exe Explorer.EXE PID 472 wrote to memory of 1212 472 ysdanei.exe Explorer.EXE PID 472 wrote to memory of 1804 472 ysdanei.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 472 wrote to memory of 1804 472 ysdanei.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 472 wrote to memory of 1804 472 ysdanei.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 472 wrote to memory of 1804 472 ysdanei.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 472 wrote to memory of 1804 472 ysdanei.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 472 wrote to memory of 336 472 ysdanei.exe cmd.exe PID 472 wrote to memory of 336 472 ysdanei.exe cmd.exe PID 472 wrote to memory of 336 472 ysdanei.exe cmd.exe PID 472 wrote to memory of 336 472 ysdanei.exe cmd.exe PID 472 wrote to memory of 336 472 ysdanei.exe cmd.exe PID 472 wrote to memory of 1360 472 ysdanei.exe DllHost.exe PID 472 wrote to memory of 1360 472 ysdanei.exe DllHost.exe PID 472 wrote to memory of 1360 472 ysdanei.exe DllHost.exe PID 472 wrote to memory of 1360 472 ysdanei.exe DllHost.exe PID 472 wrote to memory of 1360 472 ysdanei.exe DllHost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcc8a6eeb.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exe"C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exe"C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpbd23ab3e.bat"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpbd23ab3e.batMD5
b3efa8a1e4219e9f78b209dcd9a5dac2
SHA14cc9aa5419f4f0f341fb38483a9db4a107595588
SHA256ae6f14c2a530f7b61df43518a245503c743d9d3e42480e8b06a66261746023e0
SHA512f4cc35df75bcca41fa1259a8329b18ffa3ea6242d5218f4833dc577dc4abd4a0aa1bed97869f7a02b0a4474bd5c94f38a51b912397de327345bd508b15ba8565
-
C:\Users\Admin\AppData\Local\Temp\tmpcc8a6eeb.batMD5
847190283db685b8bdbf5dfe9778b1f0
SHA11ec7c4a6dad20f82d2444c80b8194e98ea9b3603
SHA256f679cc79632a8c09f1e9aac6568d7cd624fab308d498fac1dbe55a438181a05f
SHA512d60683dcd808be29a65cc308ab615ad8a263b9cba21c46acb1dfaac44a3ecc263d55e772d4a3d04a7080f3162bb63d1f4b09507511f71249e768f9ff05b60c9d
-
C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exeMD5
5e75621e4512f32af13eace1825e891b
SHA181835a56f87f48549dd663ad17fc59c06729e0a2
SHA2567f876fc75892832c8febeb07b1964a1588825646251137722c158317ef2d108c
SHA51206f6b54914ffd3346da430a610f105b30486a6d2eb8b10c5aa5bec8ce901895af6ea276a4f3ed5782e24464384b12a352844e9572476c61511b1ca3064f24c7e
-
C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exeMD5
5e75621e4512f32af13eace1825e891b
SHA181835a56f87f48549dd663ad17fc59c06729e0a2
SHA2567f876fc75892832c8febeb07b1964a1588825646251137722c158317ef2d108c
SHA51206f6b54914ffd3346da430a610f105b30486a6d2eb8b10c5aa5bec8ce901895af6ea276a4f3ed5782e24464384b12a352844e9572476c61511b1ca3064f24c7e
-
C:\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exeMD5
5e75621e4512f32af13eace1825e891b
SHA181835a56f87f48549dd663ad17fc59c06729e0a2
SHA2567f876fc75892832c8febeb07b1964a1588825646251137722c158317ef2d108c
SHA51206f6b54914ffd3346da430a610f105b30486a6d2eb8b10c5aa5bec8ce901895af6ea276a4f3ed5782e24464384b12a352844e9572476c61511b1ca3064f24c7e
-
\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exeMD5
5e75621e4512f32af13eace1825e891b
SHA181835a56f87f48549dd663ad17fc59c06729e0a2
SHA2567f876fc75892832c8febeb07b1964a1588825646251137722c158317ef2d108c
SHA51206f6b54914ffd3346da430a610f105b30486a6d2eb8b10c5aa5bec8ce901895af6ea276a4f3ed5782e24464384b12a352844e9572476c61511b1ca3064f24c7e
-
\Users\Admin\AppData\Roaming\Yqibsy\ysdanei.exeMD5
5e75621e4512f32af13eace1825e891b
SHA181835a56f87f48549dd663ad17fc59c06729e0a2
SHA2567f876fc75892832c8febeb07b1964a1588825646251137722c158317ef2d108c
SHA51206f6b54914ffd3346da430a610f105b30486a6d2eb8b10c5aa5bec8ce901895af6ea276a4f3ed5782e24464384b12a352844e9572476c61511b1ca3064f24c7e
-
memory/336-81-0x0000000000000000-mapping.dmp
-
memory/336-85-0x0000000000140000-0x0000000000167000-memory.dmpFilesize
156KB
-
memory/1056-75-0x0000000000000000-mapping.dmp
-
memory/1464-66-0x0000000000000000-mapping.dmp
-
memory/1636-69-0x0000000000000000-mapping.dmp
-
memory/1804-60-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1804-64-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1804-63-0x0000000076A01000-0x0000000076A03000-memory.dmpFilesize
8KB
-
memory/1804-65-0x0000000000401000-0x0000000000422000-memory.dmpFilesize
132KB
-
memory/1804-82-0x000000000040E0F1-mapping.dmp
-
memory/1804-61-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB