Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
17/05/2022, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
Balance_Payment.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Balance_Payment.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target Balance_Payment.exe
- Size 1010KB
- Sample220517-qthnrsfbfr
- SHA256 4318422cce325ea41065183cfbd8da31ae43d27d467c02476123b84bddaa6eb3
- MD5 2f90d76d363cd7aef35354ec811e9692
- SHA1 541bf4e5fa5fbec25374bef131c59070da9d3c4a
- SHA512 9879f71c4aa56f26ce5964f189c84e807e44f3e7634e9f3e707f3493a11703c92a60c555e3b95f682e89ab1fcfcbd7ace91339d261094f55ebee6a97b55cb3d3
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4572 yrqs.sfx.exe 4468 yrqs.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Balance_Payment.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation yrqs.sfx.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook yrqs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook yrqs.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 yrqs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier yrqs.exe - Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe 4468 yrqs.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4468 yrqs.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3976 wrote to memory of 1404 3976 Balance_Payment.exe 77 PID 3976 wrote to memory of 1404 3976 Balance_Payment.exe 77 PID 3976 wrote to memory of 1404 3976 Balance_Payment.exe 77 PID 1404 wrote to memory of 4572 1404 cmd.exe 80 PID 1404 wrote to memory of 4572 1404 cmd.exe 80 PID 1404 wrote to memory of 4572 1404 cmd.exe 80 PID 4572 wrote to memory of 4468 4572 yrqs.sfx.exe 81 PID 4572 wrote to memory of 4468 4572 yrqs.sfx.exe 81 - outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe - outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yrqs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Balance_Payment.exe"C:\Users\Admin\AppData\Local\Temp\Balance_Payment.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\jhyuonsdjhj.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Roaming\yrqs.sfx.exeyrqs.sfx.exe -pfbjrnghqwioGfnmgfbnjyyqbigkvkshphedfhjmnyczcsfbfkdghfqzaHfmkdbdsskefvgrmgnfhfnvjjonawdg -dC:\Users\Admin\AppData\Roaming3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Roaming\yrqs.exe"C:\Users\Admin\AppData\Roaming\yrqs.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4468
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\jhyuonsdjhj.bat
- Size 114B
- SHA256 3b25862cd551546c83633d912bb85d96848755335b6ebf3ce168e5109d787645
- MD5 36440d3e265d2525977a07167ea9b838
- SHA1 48741c6e3e736fd5083f0def8e3741ce4e60b944
- SHA512 ccce9cfd588ae8e698c71f19cca559a9f75b55d07d8cdfd5ea59d8a3897b4f2c9e089c63905aced1196b4b2cce17ac629374acc3a70f5d116c63b502899d9293
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\yrqs.exe
- Size 600KB
- SHA256 e18d0a3c557c1e0ee767ce6d6b53b0ffde2767c075013ffdadbf33576991a34d
- MD5 1bf2f3669f6302d9ab8bb8c937731a38
- SHA1 f625a44582e4c790f3a90e5a7b896aa660166a60
- SHA512 8f3d1b1311abdab317b0caf631d50e22f63977c434fd0ae70c2725455759afc2e0811c1590b6cb16be0e00550c50b148ccaffe803403878b00a2fe2487458e4b
- SSDEEP 12288:6D9wlKx0E4sqhIiI/36H6kuTmyyAQFD2JqvCd5ICAZNMf4LwHklc65woFUqJ6cTq:hwx0E4tU36DkyAQkcad5lONMf48X69FU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\yrqs.exe
- Size 600KB
- SHA256 e18d0a3c557c1e0ee767ce6d6b53b0ffde2767c075013ffdadbf33576991a34d
- MD5 1bf2f3669f6302d9ab8bb8c937731a38
- SHA1 f625a44582e4c790f3a90e5a7b896aa660166a60
- SHA512 8f3d1b1311abdab317b0caf631d50e22f63977c434fd0ae70c2725455759afc2e0811c1590b6cb16be0e00550c50b148ccaffe803403878b00a2fe2487458e4b
- SSDEEP 12288:6D9wlKx0E4sqhIiI/36H6kuTmyyAQFD2JqvCd5ICAZNMf4LwHklc65woFUqJ6cTq:hwx0E4tU36DkyAQkcad5lONMf48X69FU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\yrqs.sfx.exe
- Size 1010KB
- SHA256 e5b58f9382fff5a9866628d243f0233616c21631981625cde4e9e92d3b3ef86e
- MD5 c0fa553d18ecae7855591c115d454ea4
- SHA1 a602e13cce53ce9d589d9c6386058204bd3ce978
- SHA512 5590c471a076c0833ee55f65de23f39af2a661be02eb9ce9ca407882b682b7ef850ea41434a7b0332fc32d1626e0167495a898bf39663ae8f90c0e82a727f31c
- SSDEEP 24576:ChvJVJdMuKYhwev2yQesmVqKdCXsNcnsfZ+Z2b:S3dKYhwmLROK0X6NfAZ2b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\yrqs.sfx.exe
- Size 1010KB
- SHA256 e5b58f9382fff5a9866628d243f0233616c21631981625cde4e9e92d3b3ef86e
- MD5 c0fa553d18ecae7855591c115d454ea4
- SHA1 a602e13cce53ce9d589d9c6386058204bd3ce978
- SHA512 5590c471a076c0833ee55f65de23f39af2a661be02eb9ce9ca407882b682b7ef850ea41434a7b0332fc32d1626e0167495a898bf39663ae8f90c0e82a727f31c
- SSDEEP 24576:ChvJVJdMuKYhwev2yQesmVqKdCXsNcnsfZ+Z2b:S3dKYhwmLROK0X6NfAZ2b
- MD5 SHA1 SHA512 SSDEEP