4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd

Analysis

max time kernel
185s
max time network
192s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
Size

904KB
MD5

ceff73b6c6ffe04ccf4e4c4a827890e1
SHA1

7ad4ed9200615b69c99892e5a3629aed86fd92ef
SHA256

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd
SHA512

c65da9ebc1e31009734a2da277b7504978084e29a110ebdde7ab4b87fa8ef4b3db17d34e1deeb978f5d37ac900edcc9271eb80f43e97e246c897cf378f297076
SSDEEP

24576:p+Fw2IgKTiyqJy0KK/MOBFR0hkD1X5fluEq2i53rlVgi:p6w2NKmyqJyxLgFR7D1X5YlJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

youbo.exe

pid process

2036 youbo.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1300 cmd.exe

pid	process
2036	youbo.exe

pid	process
1300	cmd.exe

Loads dropped DLL 11 IoCs

Processes:

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exeWerFault.exe

pid	process
964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe

Drops file in Program Files directory 5 IoCs

Processes:

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe

description	ioc	process
File created	C:\Program Files (x86)\yytx\install_1669706359.tmp	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File created	C:\Program Files (x86)\yytx\youbo.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File opened for modification	C:\Program Files (x86)\yytx\youbo.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File created	C:\Program Files (x86)\yytx\unist.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File opened for modification	C:\Program Files (x86)\yytx\unist.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1648 2036 WerFault.exe youbo.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1496 taskkill.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1768 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1496 taskkill.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

youbo.exe

pid process

2036 youbo.exe
2036 youbo.exe
2036 youbo.exe
2036 youbo.exe

pid	pid_target	process	target process
1648	2036	WerFault.exe	youbo.exe

pid	process
1496	taskkill.exe

pid	process
1768	PING.EXE

description	pid	process
Token: SeDebugPrivilege	1496	taskkill.exe

pid	process
2036	youbo.exe
2036	youbo.exe
2036	youbo.exe
2036	youbo.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.execmd.exeyoubo.exe

description	pid	process	target process
PID 964 wrote to memory of 2036	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	youbo.exe
PID 964 wrote to memory of 2036	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	youbo.exe
PID 964 wrote to memory of 2036	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	youbo.exe
PID 964 wrote to memory of 2036	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	youbo.exe
PID 964 wrote to memory of 1300	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	cmd.exe
PID 964 wrote to memory of 1300	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	cmd.exe
PID 964 wrote to memory of 1300	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	cmd.exe
PID 964 wrote to memory of 1300	964	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	cmd.exe
PID 1300 wrote to memory of 1768	1300	cmd.exe	PING.EXE
PID 1300 wrote to memory of 1768	1300	cmd.exe	PING.EXE
PID 1300 wrote to memory of 1768	1300	cmd.exe	PING.EXE
PID 1300 wrote to memory of 1768	1300	cmd.exe	PING.EXE
PID 1300 wrote to memory of 1496	1300	cmd.exe	taskkill.exe
PID 1300 wrote to memory of 1496	1300	cmd.exe	taskkill.exe
PID 1300 wrote to memory of 1496	1300	cmd.exe	taskkill.exe
PID 1300 wrote to memory of 1496	1300	cmd.exe	taskkill.exe
PID 2036 wrote to memory of 1648	2036	youbo.exe	WerFault.exe
PID 2036 wrote to memory of 1648	2036	youbo.exe	WerFault.exe
PID 2036 wrote to memory of 1648	2036	youbo.exe	WerFault.exe
PID 2036 wrote to memory of 1648	2036	youbo.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
"C:\Users\Admin\AppData\Local\Temp\4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:964

C:\Program Files (x86)\yytx\youbo.exe
"C:\Program Files (x86)\yytx\youbo.exe" inst
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 608
3⤵
- Loads dropped DLL
- Program crash
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Tempa.bat
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 /n 5
3⤵
- Runs ping.exe
PID:1768

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM 4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
C:\Users\Admin\AppData\Local\Tempa.bat
Filesize
357B

MD5
cebcfeee035fb75553e7ccb6d9f7da16

SHA1
b0811280eb72299ffcbb54119200ecd87109e747

SHA256
cb686fb5eee787b4a152673270d9a51ca9d37262ae560ffb876318193b67221c

SHA512
44dead96d23ad227a56835a97d98b4530495bdbc8e9d277c6a9cd5253cecfd255a9bc3d1694a422c13f3e7c002c9ea5e88b7c7f7b02a9127825715cf03c3a81c

Download Submit
C:\Users\Admin\AppData\Local\yytx\config.ini
Filesize
94B

MD5
b7cd0cb10b659cc2cb41e94589865352

SHA1
8f7e1bfd887ed76e02099dfc8041a77ac8b4f07c

SHA256
88e8cb6584ffb1decf69503fbf881e3e636fa776fbbb19c8f7e36d79597429b9

SHA512
67b7c5fc6dadc0424ddad66d7d4828ce165a3271cd41691afc7483979f0e56382b03a5313c995049464dc64b6e1221a55b989486edab0b977f87c1ac5926f408

Download Submit
\Program Files (x86)\yytx\unist.exe
Filesize
298KB

MD5
c757a37058811d8b129d2e16c7027f2d

SHA1
819298918fae59743360497f4cbf1b483bd5923b

SHA256
06e0bd7b9c6448d2b4aee3128266fb19ecdfe2bd190a973805b813ec4e9f5b54

SHA512
e413eff73f87fb337bfb89c9b7565fe1a6a99ce17516b31f6f074d3239d0d8aa37065eefa92f2dffca61b827b9bc59e10b71f5fba1dc0f74efde294d4502984d

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
memory/964-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1300-63-0x0000000000000000-mapping.dmp

Download
memory/1496-66-0x0000000000000000-mapping.dmp

Download
memory/1648-67-0x0000000000000000-mapping.dmp

Download
memory/1768-65-0x0000000000000000-mapping.dmp

Download
memory/2036-59-0x0000000000000000-mapping.dmp

Download