9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65

General

Target

9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe
Size

220KB
MD5

5fed7e44eba347179a31aaf272dc738e
SHA1

2ff6f3f5500fdd96a5a907e2dc5d49312b71bf2f
SHA256

9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65
SHA512

c10d3801b8d051156f7a90c3a2aacf56063af1d1a9d2f43a11493e096bf0a5b41d55fc056dda51f615fe4c6adce89d86a623597f680c069d8b62f870e2d18b93
SSDEEP

6144:aUAKhI22QqI6YDSQICvORT8r4EhI0RX7W4h9:aUAa955vOh8rPhd44T

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

yudit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yudit.exe

Executes dropped EXE 1 IoCs

Processes:

yudit.exe

pid process

3168 yudit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

yudit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /U"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /y"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /p"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /z"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /x"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /w"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /F"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /O"	yudit.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /R"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /r"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /u"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /B"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /f"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /m"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /P"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /A"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /J"	yudit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yudit = "C:\\Users\\Admin\\yudit.exe /W"	yudit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

yudit.exe

pid	process
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe
3168	yudit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exeyudit.exe

pid process

816 9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe
3168 yudit.exe

pid	process
816	9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe
3168	yudit.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe

description	pid	process	target process
PID 816 wrote to memory of 3168	816	9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe	yudit.exe
PID 816 wrote to memory of 3168	816	9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe	yudit.exe
PID 816 wrote to memory of 3168	816	9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe	yudit.exe

C:\Users\Admin\AppData\Local\Temp\9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe
"C:\Users\Admin\AppData\Local\Temp\9c8ef03a2723823dc009696d91b47d93188ccb7c8fe3e099388e8dd5bd008a65.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816

C:\Users\Admin\yudit.exe
"C:\Users\Admin\yudit.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yudit.exe

Filesize
220KB

MD5
5fb19005984a3d7412e19c9f7aa5231e

SHA1
bca7f196581d25c9491ef014c900ce0088bc84a5

SHA256
a01c189c5ef6ad70ee1b2e1bb0f8cd413f65eacdb4b76a3bbe34c8db0ad86f2b

SHA512
a68916a6bea2d5b16c10119300de82b6dface867cc89aa44aa50a0ee15ef9373eb3f9c83606a14fa610ce65b40db2ab4a58d15e1e9cfab6b0824fe1173987c7e

Download Submit
C:\Users\Admin\yudit.exe

Filesize
220KB

MD5
5fb19005984a3d7412e19c9f7aa5231e

SHA1
bca7f196581d25c9491ef014c900ce0088bc84a5

SHA256
a01c189c5ef6ad70ee1b2e1bb0f8cd413f65eacdb4b76a3bbe34c8db0ad86f2b

SHA512
a68916a6bea2d5b16c10119300de82b6dface867cc89aa44aa50a0ee15ef9373eb3f9c83606a14fa610ce65b40db2ab4a58d15e1e9cfab6b0824fe1173987c7e

Download Submit
memory/3168-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads