Analysis
-
max time kernel
94s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 00:07
Static task
static1
Behavioral task
behavioral1
Sample
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe
Resource
win7-20220812-en
General
-
Target
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe
-
Size
491KB
-
MD5
ebd7aea5d363a032c19d3f58bfaaf802
-
SHA1
75555e23db0ffe361a4cc71522ea603bad8a5b42
-
SHA256
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
-
SHA512
d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
SSDEEP
3072:zaHqHL+1tc0ZioAX2uq5RhVYtfZ14sBEDErAgsafvWab4sBEDErAgsaf7:zaULim0ZUohVYtfZuBgs93Bgsy
Malware Config
Extracted
pony
http://185.7.34.251/~umord163/decpony/gate.php
Signatures
-
Executes dropped EXE 13 IoCs
Processes:
ywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exepid process 884 ywhs.exe 952 ywhs.exe 1564 ywhs.exe 604 ywhs.exe 292 ywhs.exe 1344 ywhs.exe 1264 ywhs.exe 1700 ywhs.exe 1504 ywhs.exe 1036 ywhs.exe 2016 ywhs.exe 1728 ywhs.exe 884 ywhs.exe -
Processes:
resource yara_rule behavioral1/memory/1564-70-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1564-73-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1564-74-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1564-76-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1564-78-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1344-96-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1344-94-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1344-98-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1344-100-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1504-114-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1504-118-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1504-122-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1728-141-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1728-142-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1300-162-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1300-163-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1300-165-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1744-184-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1744-185-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
ywhs.exepid process 952 ywhs.exe -
Drops startup file 1 IoCs
Processes:
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sbdsw.vbs 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe -
Loads dropped DLL 1 IoCs
Processes:
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exepid process 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 4 IoCs
Processes:
ywhs.exeywhs.exeywhs.exeywhs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts ywhs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts ywhs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts ywhs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts ywhs.exe -
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
Processes:
ywhs.exeywhs.exeywhs.exeywhs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ywhs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ywhs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ywhs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ywhs.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
ywhs.exeywhs.exeywhs.exeywhs.exedescription pid process target process PID 884 set thread context of 1564 884 ywhs.exe ywhs.exe PID 292 set thread context of 1344 292 ywhs.exe ywhs.exe PID 1700 set thread context of 1504 1700 ywhs.exe ywhs.exe PID 2016 set thread context of 1728 2016 ywhs.exe ywhs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ywhs.exeywhs.exeywhs.exeywhs.exepid process 604 ywhs.exe 604 ywhs.exe 604 ywhs.exe 604 ywhs.exe 604 ywhs.exe 604 ywhs.exe 604 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1264 ywhs.exe 1036 ywhs.exe 1036 ywhs.exe 884 ywhs.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ywhs.exeywhs.exedescription pid process Token: SeImpersonatePrivilege 1564 ywhs.exe Token: SeTcbPrivilege 1564 ywhs.exe Token: SeChangeNotifyPrivilege 1564 ywhs.exe Token: SeCreateTokenPrivilege 1564 ywhs.exe Token: SeBackupPrivilege 1564 ywhs.exe Token: SeRestorePrivilege 1564 ywhs.exe Token: SeIncreaseQuotaPrivilege 1564 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1564 ywhs.exe Token: SeImpersonatePrivilege 1564 ywhs.exe Token: SeTcbPrivilege 1564 ywhs.exe Token: SeChangeNotifyPrivilege 1564 ywhs.exe Token: SeCreateTokenPrivilege 1564 ywhs.exe Token: SeBackupPrivilege 1564 ywhs.exe Token: SeRestorePrivilege 1564 ywhs.exe Token: SeIncreaseQuotaPrivilege 1564 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1564 ywhs.exe Token: SeImpersonatePrivilege 1564 ywhs.exe Token: SeTcbPrivilege 1564 ywhs.exe Token: SeChangeNotifyPrivilege 1564 ywhs.exe Token: SeCreateTokenPrivilege 1564 ywhs.exe Token: SeBackupPrivilege 1564 ywhs.exe Token: SeRestorePrivilege 1564 ywhs.exe Token: SeIncreaseQuotaPrivilege 1564 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1564 ywhs.exe Token: SeImpersonatePrivilege 1564 ywhs.exe Token: SeTcbPrivilege 1564 ywhs.exe Token: SeChangeNotifyPrivilege 1564 ywhs.exe Token: SeCreateTokenPrivilege 1564 ywhs.exe Token: SeBackupPrivilege 1564 ywhs.exe Token: SeRestorePrivilege 1564 ywhs.exe Token: SeIncreaseQuotaPrivilege 1564 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1564 ywhs.exe Token: SeImpersonatePrivilege 1344 ywhs.exe Token: SeTcbPrivilege 1344 ywhs.exe Token: SeChangeNotifyPrivilege 1344 ywhs.exe Token: SeCreateTokenPrivilege 1344 ywhs.exe Token: SeBackupPrivilege 1344 ywhs.exe Token: SeRestorePrivilege 1344 ywhs.exe Token: SeIncreaseQuotaPrivilege 1344 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1344 ywhs.exe Token: SeImpersonatePrivilege 1344 ywhs.exe Token: SeTcbPrivilege 1344 ywhs.exe Token: SeChangeNotifyPrivilege 1344 ywhs.exe Token: SeCreateTokenPrivilege 1344 ywhs.exe Token: SeBackupPrivilege 1344 ywhs.exe Token: SeRestorePrivilege 1344 ywhs.exe Token: SeIncreaseQuotaPrivilege 1344 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1344 ywhs.exe Token: SeImpersonatePrivilege 1344 ywhs.exe Token: SeTcbPrivilege 1344 ywhs.exe Token: SeChangeNotifyPrivilege 1344 ywhs.exe Token: SeCreateTokenPrivilege 1344 ywhs.exe Token: SeBackupPrivilege 1344 ywhs.exe Token: SeRestorePrivilege 1344 ywhs.exe Token: SeIncreaseQuotaPrivilege 1344 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1344 ywhs.exe Token: SeImpersonatePrivilege 1344 ywhs.exe Token: SeTcbPrivilege 1344 ywhs.exe Token: SeChangeNotifyPrivilege 1344 ywhs.exe Token: SeCreateTokenPrivilege 1344 ywhs.exe Token: SeBackupPrivilege 1344 ywhs.exe Token: SeRestorePrivilege 1344 ywhs.exe Token: SeIncreaseQuotaPrivilege 1344 ywhs.exe Token: SeAssignPrimaryTokenPrivilege 1344 ywhs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exeywhs.exedescription pid process target process PID 1776 wrote to memory of 884 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 1776 wrote to memory of 884 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 1776 wrote to memory of 884 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 1776 wrote to memory of 884 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 1776 wrote to memory of 952 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 1776 wrote to memory of 952 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 1776 wrote to memory of 952 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 1776 wrote to memory of 952 1776 982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 1564 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 604 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 604 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 604 884 ywhs.exe ywhs.exe PID 884 wrote to memory of 604 884 ywhs.exe ywhs.exe PID 1564 wrote to memory of 1624 1564 ywhs.exe cmd.exe PID 1564 wrote to memory of 1624 1564 ywhs.exe cmd.exe PID 1564 wrote to memory of 1624 1564 ywhs.exe cmd.exe PID 1564 wrote to memory of 1624 1564 ywhs.exe cmd.exe PID 604 wrote to memory of 292 604 ywhs.exe ywhs.exe PID 604 wrote to memory of 292 604 ywhs.exe ywhs.exe PID 604 wrote to memory of 292 604 ywhs.exe ywhs.exe PID 604 wrote to memory of 292 604 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1344 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1264 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1264 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1264 292 ywhs.exe ywhs.exe PID 292 wrote to memory of 1264 292 ywhs.exe ywhs.exe PID 1344 wrote to memory of 928 1344 ywhs.exe cmd.exe PID 1344 wrote to memory of 928 1344 ywhs.exe cmd.exe PID 1344 wrote to memory of 928 1344 ywhs.exe cmd.exe PID 1344 wrote to memory of 928 1344 ywhs.exe cmd.exe PID 1264 wrote to memory of 1700 1264 ywhs.exe ywhs.exe PID 1264 wrote to memory of 1700 1264 ywhs.exe ywhs.exe PID 1264 wrote to memory of 1700 1264 ywhs.exe ywhs.exe PID 1264 wrote to memory of 1700 1264 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1504 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1036 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1036 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1036 1700 ywhs.exe ywhs.exe PID 1700 wrote to memory of 1036 1700 ywhs.exe ywhs.exe PID 1504 wrote to memory of 1928 1504 ywhs.exe cmd.exe PID 1504 wrote to memory of 1928 1504 ywhs.exe cmd.exe PID 1504 wrote to memory of 1928 1504 ywhs.exe cmd.exe PID 1504 wrote to memory of 1928 1504 ywhs.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
ywhs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ywhs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe"C:\Users\Admin\AppData\Local\Temp\982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7120213.bat" "C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" "4⤵PID:1624
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" 42378Mh OIDIQNARP 15643⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7154907.bat" "C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" "6⤵PID:928
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" 42378Mh OIDIQNARP 13445⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"7⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7160243.bat" "C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" "8⤵PID:1928
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" 42378Mh OIDIQNARP 15047⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1036 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2016 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"9⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7179883.bat" "C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" "10⤵PID:1144
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" 42378Mh OIDIQNARP 17289⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:884 -
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"10⤵PID:584
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"11⤵PID:1300
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7217901.bat" "C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" "12⤵PID:1088
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" 42378Mh OIDIQNARP 130011⤵PID:1548
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"12⤵PID:360
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"13⤵PID:1744
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" 42378Mh OIDIQNARP 174413⤵PID:552
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe"C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exe" B9180AMf PFREKKVDV "C:\Users\Admin\AppData\Local\Temp\982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe"2⤵
- Executes dropped EXE
- Deletes itself
PID:952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7120213.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\7154907.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\7160243.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\7179883.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\7217901.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
C:\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Roaming\Eythjr\ywhs.exeFilesize
491KB
MD5ebd7aea5d363a032c19d3f58bfaaf802
SHA175555e23db0ffe361a4cc71522ea603bad8a5b42
SHA256982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
SHA512d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
memory/292-81-0x0000000000000000-mapping.dmp
-
memory/360-167-0x0000000000000000-mapping.dmp
-
memory/552-177-0x0000000000000000-mapping.dmp
-
memory/584-145-0x0000000000000000-mapping.dmp
-
memory/604-69-0x0000000000000000-mapping.dmp
-
memory/884-134-0x0000000000000000-mapping.dmp
-
memory/884-56-0x0000000000000000-mapping.dmp
-
memory/928-99-0x0000000000000000-mapping.dmp
-
memory/952-57-0x0000000000000000-mapping.dmp
-
memory/1036-112-0x0000000000000000-mapping.dmp
-
memory/1088-164-0x0000000000000000-mapping.dmp
-
memory/1144-143-0x0000000000000000-mapping.dmp
-
memory/1264-90-0x0000000000000000-mapping.dmp
-
memory/1300-165-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1300-163-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1300-162-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1300-153-0x000000000041AF60-mapping.dmp
-
memory/1344-98-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1344-89-0x000000000041AF60-mapping.dmp
-
memory/1344-100-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1344-94-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1344-96-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1504-114-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1504-110-0x000000000041AF60-mapping.dmp
-
memory/1504-118-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1504-122-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1548-155-0x0000000000000000-mapping.dmp
-
memory/1564-65-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1564-73-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1564-62-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1564-76-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1564-78-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1564-74-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1564-70-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1564-67-0x000000000041AF60-mapping.dmp
-
memory/1564-66-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1624-77-0x0000000000000000-mapping.dmp
-
memory/1700-102-0x0000000000000000-mapping.dmp
-
memory/1728-142-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1728-132-0x000000000041AF60-mapping.dmp
-
memory/1728-141-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1744-175-0x000000000041AF60-mapping.dmp
-
memory/1744-184-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1744-185-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1776-54-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB
-
memory/1928-121-0x0000000000000000-mapping.dmp
-
memory/2016-124-0x0000000000000000-mapping.dmp