4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd

General

Target

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
Size

904KB
MD5

ceff73b6c6ffe04ccf4e4c4a827890e1
SHA1

7ad4ed9200615b69c99892e5a3629aed86fd92ef
SHA256

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd
SHA512

c65da9ebc1e31009734a2da277b7504978084e29a110ebdde7ab4b87fa8ef4b3db17d34e1deeb978f5d37ac900edcc9271eb80f43e97e246c897cf378f297076
SSDEEP

24576:p+Fw2IgKTiyqJy0KK/MOBFR0hkD1X5fluEq2i53rlVgi:p6w2NKmyqJyxLgFR7D1X5YlJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

youbo.exe

pid process

2244 youbo.exe

pid	process
2244	youbo.exe

Drops file in Program Files directory 5 IoCs

Processes:

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\yytx\youbo.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File created	C:\Program Files (x86)\yytx\unist.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File opened for modification	C:\Program Files (x86)\yytx\unist.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File created	C:\Program Files (x86)\yytx\install_1669706355.tmp	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
File created	C:\Program Files (x86)\yytx\youbo.exe	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2712 2244 WerFault.exe youbo.exe
3996 2244 WerFault.exe youbo.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1200 taskkill.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3916 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1200 taskkill.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

youbo.exe

pid process

2244 youbo.exe
2244 youbo.exe
2244 youbo.exe
2244 youbo.exe

pid	pid_target	process	target process
2712	2244	WerFault.exe	youbo.exe
3996	2244	WerFault.exe	youbo.exe

pid	process
1200	taskkill.exe

pid	process
3916	PING.EXE

description	pid	process
Token: SeDebugPrivilege	1200	taskkill.exe

pid	process
2244	youbo.exe
2244	youbo.exe
2244	youbo.exe
2244	youbo.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.execmd.exeyoubo.exe

description	pid	process	target process
PID 436 wrote to memory of 2244	436	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	youbo.exe
PID 436 wrote to memory of 2244	436	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	youbo.exe
PID 436 wrote to memory of 2244	436	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	youbo.exe
PID 436 wrote to memory of 1452	436	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	cmd.exe
PID 436 wrote to memory of 1452	436	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	cmd.exe
PID 436 wrote to memory of 1452	436	4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe	cmd.exe
PID 1452 wrote to memory of 3916	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 3916	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 3916	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 1200	1452	cmd.exe	taskkill.exe
PID 1452 wrote to memory of 1200	1452	cmd.exe	taskkill.exe
PID 1452 wrote to memory of 1200	1452	cmd.exe	taskkill.exe
PID 2244 wrote to memory of 3996	2244	youbo.exe	WerFault.exe
PID 2244 wrote to memory of 3996	2244	youbo.exe	WerFault.exe
PID 2244 wrote to memory of 3996	2244	youbo.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
"C:\Users\Admin\AppData\Local\Temp\4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:436

C:\Program Files (x86)\yytx\youbo.exe
"C:\Program Files (x86)\yytx\youbo.exe" inst
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 1732
3⤵
- Program crash
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 1732
3⤵
- Program crash
PID:3996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Tempa.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 /n 5
3⤵
- Runs ping.exe
PID:3916

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM 4df7dcc3326fd512b7f042332343a814e4e2107ac6665b450c0532127abdfadd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2244 -ip 2244
1⤵
PID:3304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
C:\Program Files (x86)\yytx\youbo.exe
Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit
C:\Users\Admin\AppData\Local\Tempa.bat
Filesize
357B

MD5
cebcfeee035fb75553e7ccb6d9f7da16

SHA1
b0811280eb72299ffcbb54119200ecd87109e747

SHA256
cb686fb5eee787b4a152673270d9a51ca9d37262ae560ffb876318193b67221c

SHA512
44dead96d23ad227a56835a97d98b4530495bdbc8e9d277c6a9cd5253cecfd255a9bc3d1694a422c13f3e7c002c9ea5e88b7c7f7b02a9127825715cf03c3a81c

Download Submit
C:\Users\Admin\AppData\Local\yytx\config.ini
Filesize
94B

MD5
aa7dfb9b26ebb1002523315a1df81ca0

SHA1
c8cc89d3b7f0e9299f7ad763209816af0ca99bf9

SHA256
2dfaaa1053581646ddd0caf1df3519aaedf19961a8ed97f2e43cba000dfd3dcc

SHA512
ef9687567f126716ef24bd1bfc13c08e040c5445bc47dc6c198c40a804c4fd2f477633adff82cffad9faed09854f37ca8296feb3af5f430149d648cb30ad1644

Download Submit
memory/1200-139-0x0000000000000000-mapping.dmp

Download
memory/1452-136-0x0000000000000000-mapping.dmp

Download
memory/2244-132-0x0000000000000000-mapping.dmp

Download
memory/3916-138-0x0000000000000000-mapping.dmp

Download
memory/3996-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing