Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 19:29
Static task
static1
Behavioral task
behavioral1
Sample
d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe
-
Size
301KB
-
MD5
90375d6f4609762178bfff4cf8c26128
-
SHA1
e94a3f3e650a6dc2fef3a5d4de5d1988c9ec4f1a
-
SHA256
d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511
-
SHA512
611e441172c6f1e1df76c55c4a71f9b1326b950aea4c89c76b164dcba26397f1aa675a3703867fbcbcd905bc7b82079ce64c8b4678e8ba193b680379f3c15451
-
SSDEEP
6144:XNuRO5JtJH+vvOh1R48zsY3IqgOUYAVUpFAz8TwViigqHnih:XKO7H+v2HTswvUYJAYgHih
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5036 ylos.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run ylos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylos = "C:\\Users\\Admin\\AppData\\Roaming\\Hurouk\\ylos.exe" ylos.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4800 set thread context of 392 4800 d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe 85 -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe 5036 ylos.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 5036 4800 d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe 84 PID 4800 wrote to memory of 5036 4800 d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe 84 PID 4800 wrote to memory of 5036 4800 d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe 84 PID 5036 wrote to memory of 2780 5036 ylos.exe 43 PID 5036 wrote to memory of 2780 5036 ylos.exe 43 PID 5036 wrote to memory of 2780 5036 ylos.exe 43 PID 5036 wrote to memory of 2780 5036 ylos.exe 43 PID 5036 wrote to memory of 2780 5036 ylos.exe 43 PID 5036 wrote to memory of 2820 5036 ylos.exe 42 PID 5036 wrote to memory of 2820 5036 ylos.exe 42 PID 5036 wrote to memory of 2820 5036 ylos.exe 42 PID 5036 wrote to memory of 2820 5036 ylos.exe 42 PID 5036 wrote to memory of 2820 5036 ylos.exe 42 PID 5036 wrote to memory of 2932 5036 ylos.exe 41 PID 5036 wrote to memory of 2932 5036 ylos.exe 41 PID 5036 wrote to memory of 2932 5036 ylos.exe 41 PID 5036 wrote to memory of 2932 5036 ylos.exe 41 PID 5036 wrote to memory of 2932 5036 ylos.exe 41 PID 5036 wrote to memory of 1084 5036 ylos.exe 40 PID 5036 wrote to memory of 1084 5036 ylos.exe 40 PID 5036 wrote to memory of 1084 5036 ylos.exe 40 PID 5036 wrote to memory of 1084 5036 ylos.exe 40 PID 5036 wrote to memory of 1084 5036 ylos.exe 40 PID 5036 wrote to memory of 3124 5036 ylos.exe 39 PID 5036 wrote to memory of 3124 5036 ylos.exe 39 PID 5036 wrote to memory of 3124 5036 ylos.exe 39 PID 5036 wrote to memory of 3124 5036 ylos.exe 39 PID 5036 wrote to memory of 3124 5036 ylos.exe 39 PID 5036 wrote to memory of 3344 5036 ylos.exe 38 PID 5036 wrote to memory of 3344 5036 ylos.exe 38 PID 5036 wrote to memory of 3344 5036 ylos.exe 38 PID 5036 wrote to memory of 3344 5036 ylos.exe 38 PID 5036 wrote to memory of 3344 5036 ylos.exe 38 PID 5036 wrote to memory of 3436 5036 ylos.exe 37 PID 5036 wrote to memory of 3436 5036 ylos.exe 37 PID 5036 wrote to memory of 3436 5036 ylos.exe 37 PID 5036 wrote to memory of 3436 5036 ylos.exe 37 PID 5036 wrote to memory of 3436 5036 ylos.exe 37 PID 5036 wrote to memory of 3508 5036 ylos.exe 36 PID 5036 wrote to memory of 3508 5036 ylos.exe 36 PID 5036 wrote to memory of 3508 5036 ylos.exe 36 PID 5036 wrote to memory of 3508 5036 ylos.exe 36 PID 5036 wrote to memory of 3508 5036 ylos.exe 36 PID 5036 wrote to memory of 3596 5036 ylos.exe 35 PID 5036 wrote to memory of 3596 5036 ylos.exe 35 PID 5036 wrote to memory of 3596 5036 ylos.exe 35 PID 5036 wrote to memory of 3596 5036 ylos.exe 35 PID 5036 wrote to memory of 3596 5036 ylos.exe 35 PID 5036 wrote to memory of 3740 5036 ylos.exe 34 PID 5036 wrote to memory of 3740 5036 ylos.exe 34 PID 5036 wrote to memory of 3740 5036 ylos.exe 34 PID 5036 wrote to memory of 3740 5036 ylos.exe 34 PID 5036 wrote to memory of 3740 5036 ylos.exe 34 PID 5036 wrote to memory of 4648 5036 ylos.exe 31 PID 5036 wrote to memory of 4648 5036 ylos.exe 31 PID 5036 wrote to memory of 4648 5036 ylos.exe 31 PID 5036 wrote to memory of 4648 5036 ylos.exe 31 PID 5036 wrote to memory of 4648 5036 ylos.exe 31 PID 5036 wrote to memory of 4900 5036 ylos.exe 14 PID 5036 wrote to memory of 4900 5036 ylos.exe 14 PID 5036 wrote to memory of 4900 5036 ylos.exe 14 PID 5036 wrote to memory of 4900 5036 ylos.exe 14 PID 5036 wrote to memory of 4900 5036 ylos.exe 14 PID 5036 wrote to memory of 4800 5036 ylos.exe 83
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4900
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4648
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3596
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3508
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3436
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3124
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe"C:\Users\Admin\AppData\Local\Temp\d0e5fdfce2e4d593c33a9ede752218ff707b78d6b0008e9d5fd5f04a01dbe511.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Roaming\Hurouk\ylos.exe"C:\Users\Admin\AppData\Roaming\Hurouk\ylos.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\QPA65F1.bat"3⤵PID:392
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2820
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
303B
MD5aa5842941017857b581136bcef2f030f
SHA130d72d85d4c7c26658c276dca4f7688174378442
SHA256bc404409565801fec1aa71b6d2051b569000ccc24539348c27da6c7f7b4d5d15
SHA512c72b4f3753863065881b9fa1ae5c01ed1f266201b994894a678e98b67db53cfcc0ad4cc067c66ef8b8b60bd59d753c9e97daaf9e91dae3b693aa870fcbf5c273
-
Filesize
301KB
MD5e2fdfc3dde063ff6c6649936c4ba1ab0
SHA11b68e2de284d19117fd155ca87c0a4836850488f
SHA256a2b12f970ab85848a0fedcfb55245a6f03cd34b64d6299fab88520b9a17efec7
SHA5120a629e192c5900dc491339a4a6c5ae35bc4fb8ba5de464fe12306545216b06993e0d7cdf49cace4d86eb7ad39d9f14b9bbd7ccede71e08182ea4d2bf19552edf
-
Filesize
301KB
MD5e2fdfc3dde063ff6c6649936c4ba1ab0
SHA11b68e2de284d19117fd155ca87c0a4836850488f
SHA256a2b12f970ab85848a0fedcfb55245a6f03cd34b64d6299fab88520b9a17efec7
SHA5120a629e192c5900dc491339a4a6c5ae35bc4fb8ba5de464fe12306545216b06993e0d7cdf49cace4d86eb7ad39d9f14b9bbd7ccede71e08182ea4d2bf19552edf