5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f

General

Target

5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe
Size

4.3MB
MD5

d5f72fb88908d47ac3b805f245762556
SHA1

66f804eb29683e9853859a039d6dea849c20d84f
SHA256

5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f
SHA512

28412abc9061fe295932e26b848577ca1ccd5b82014806e8d428cd34298ec7cec35de4442c8139eaff52e9389926725ad6da2fdb898ca09816c8933175e2c06b

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

busshost.exeYTLoader.execonf.exe

pid process

3596 busshost.exe
1676 YTLoader.exe
2160 conf.exe

pid	process
3596	busshost.exe
1676	YTLoader.exe
2160	conf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

Processes:

5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\LetsSee!\YTLoader.exe	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe
File opened for modification	C:\Program Files (x86)\LetsSee!\busshost.exe	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe
File opened for modification	C:\Program Files (x86)\LetsSee!\conf.exe	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe
File opened for modification	C:\Program Files (x86)\LetsSee!\Uninstall.exe	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe
File created	C:\Program Files (x86)\LetsSee!\Uninstall.ini	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4068 1676 WerFault.exe YTLoader.exe

pid	pid_target	process	target process
4068	1676	WerFault.exe	YTLoader.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

YTLoader.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	YTLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	YTLoader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

YTLoader.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	YTLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	YTLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	YTLoader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

YTLoader.exe

description pid process

Token: SeDebugPrivilege 1676 YTLoader.exe

description	pid	process
Token: SeDebugPrivilege	1676	YTLoader.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe

description	pid	process	target process
PID 4936 wrote to memory of 3596	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	busshost.exe
PID 4936 wrote to memory of 3596	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	busshost.exe
PID 4936 wrote to memory of 3596	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	busshost.exe
PID 4936 wrote to memory of 1676	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	YTLoader.exe
PID 4936 wrote to memory of 1676	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	YTLoader.exe
PID 4936 wrote to memory of 1676	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	YTLoader.exe
PID 4936 wrote to memory of 2160	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	conf.exe
PID 4936 wrote to memory of 2160	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	conf.exe
PID 4936 wrote to memory of 2160	4936	5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe	conf.exe

C:\Users\Admin\AppData\Local\Temp\5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe
"C:\Users\Admin\AppData\Local\Temp\5ce03f0e1550e3801d7d293300b3ac745e676155cbc378b214625bdce0258a6f.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4936

C:\Program Files (x86)\LetsSee!\busshost.exe
"C:\Program Files (x86)\LetsSee!\busshost.exe"
2⤵
- Executes dropped EXE
PID:3596

C:\Program Files (x86)\LetsSee!\YTLoader.exe
"C:\Program Files (x86)\LetsSee!\YTLoader.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1588
3⤵
- Program crash
PID:4068

C:\Program Files (x86)\LetsSee!\conf.exe
"C:\Program Files (x86)\LetsSee!\conf.exe"
2⤵
- Executes dropped EXE
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1676 -ip 1676
1⤵
PID:5012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LetsSee!\YTLoader.exe
Filesize
3.0MB

MD5
adc9db2753fa3daa6a8156254ba2a5f1

SHA1
50ff27e2e1c4acc35768b93b73c03f7630027f04

SHA256
f8cc40321301d39f03eaa48d42cbbb2e953b694dc13ccf9d986032c621223fde

SHA512
5f7fca8da622035f3a83e562d727ccdd842d623ec376f93c75c3218bddd970c34a9efc66a33cfd6e52a398fa2ed090b890d05aecef53f65a22917d50d31a1195

Download Submit
C:\Program Files (x86)\LetsSee!\YTLoader.exe
Filesize
3.0MB

MD5
adc9db2753fa3daa6a8156254ba2a5f1

SHA1
50ff27e2e1c4acc35768b93b73c03f7630027f04

SHA256
f8cc40321301d39f03eaa48d42cbbb2e953b694dc13ccf9d986032c621223fde

SHA512
5f7fca8da622035f3a83e562d727ccdd842d623ec376f93c75c3218bddd970c34a9efc66a33cfd6e52a398fa2ed090b890d05aecef53f65a22917d50d31a1195

Download Submit
C:\Program Files (x86)\LetsSee!\busshost.exe
Filesize
973KB

MD5
f47bf8949ce5757c931bea4792d17dc3

SHA1
98e4aa39fce21a5742b1668ff33eeaa0b9154565

SHA256
4c92733a79f3886063f13c2d82cd28fe6a774e2f183a7e12b009be642c44dcee

SHA512
22e4901f51a6ec7948ec728c7628ddfab236f3b1ad0eef45eee81ba71a1ffcb8a252892f0e937af8be11e3b607782cbbfc1ec011555d4b70b782d52702b77fb4

Download Submit
C:\Program Files (x86)\LetsSee!\busshost.exe
Filesize
973KB

MD5
f47bf8949ce5757c931bea4792d17dc3

SHA1
98e4aa39fce21a5742b1668ff33eeaa0b9154565

SHA256
4c92733a79f3886063f13c2d82cd28fe6a774e2f183a7e12b009be642c44dcee

SHA512
22e4901f51a6ec7948ec728c7628ddfab236f3b1ad0eef45eee81ba71a1ffcb8a252892f0e937af8be11e3b607782cbbfc1ec011555d4b70b782d52702b77fb4

Download Submit
C:\Program Files (x86)\LetsSee!\conf.exe
Filesize
1.3MB

MD5
8bdbd3d3d14ea96be9916c1f44634c8f

SHA1
b1eb12c1e1bf7b940823eefda730d2246febe2f9

SHA256
03deff86a5e327d9381687c95e3116b2223a3441fdbe855f8d4b8e41d1c4d420

SHA512
13f17c07b52749c2c1dd19ff2c24de245f437695f9846afa15110cb845ff5a961c0f7552e7230754fde51c530bc7994e621e50c8b103bb038462e84188961c10

Download Submit
memory/1676-140-0x00000000008C0000-0x0000000000BC8000-memory.dmp

Filesize
3.0MB

Download
memory/1676-135-0x0000000000000000-mapping.dmp

Download
memory/1676-141-0x0000000005CF0000-0x0000000005CFA000-memory.dmp

Filesize
40KB

Download
memory/1676-142-0x0000000005D00000-0x0000000005D08000-memory.dmp

Filesize
32KB

Download
memory/1676-143-0x0000000005E20000-0x0000000005E28000-memory.dmp

Filesize
32KB

Download
memory/1676-144-0x0000000005E30000-0x0000000005E38000-memory.dmp

Filesize
32KB

Download
memory/1676-145-0x0000000005E40000-0x0000000005E48000-memory.dmp

Filesize
32KB

Download
memory/1676-146-0x0000000005E60000-0x0000000005E68000-memory.dmp

Filesize
32KB

Download
memory/1676-147-0x0000000005E70000-0x0000000005E78000-memory.dmp

Filesize
32KB

Download
memory/1676-148-0x0000000006100000-0x0000000006108000-memory.dmp

Filesize
32KB

Download
memory/2160-138-0x0000000000000000-mapping.dmp

Download
memory/3596-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads