8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
Size

548KB
MD5

19463146fa399cb896cda232d0476107
SHA1

5c70d9405722197350300a9ce43161befbed3f4a
SHA256

8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e
SHA512

84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5
SSDEEP

12288:s2iwn/ND7S3xI66S/H3UyKxWn2hJ+MRmhhhlgNxbkP:s213Sed0XjhM7g

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe

Adds policy Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "lbbtrcbrsgwhjrdjnndd.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erodygcpnyltsxgjk.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lbbtrcbrsgwhjrdjnndd.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "xjftnupbyiubzdln.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "arslkwwnpevhktgnstkle.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "arslkwwnpevhktgnstkle.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lbbtrcbrsgwhjrdjnndd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "ynmdakixxkzjkrchkjy.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xjftnupbyiubzdln.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "lbbtrcbrsgwhjrdjnndd.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "erodygcpnyltsxgjk.exe"	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "arslkwwnpevhktgnstkle.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbzplurfeqenntdhjh.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "nbzplurfeqenntdhjh.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbzplurfeqenntdhjh.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lbbtrcbrsgwhjrdjnndd.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "nbzplurfeqenntdhjh.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "lbbtrcbrsgwhjrdjnndd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "xjftnupbyiubzdln.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pxpzpsjrkqyb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sdylekepluflils = "ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yboteco.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yboteco.exe

Executes dropped EXE 4 IoCs

pid	Process
2608	pwyrqtqlzgi.exe
5032	yboteco.exe
312	yboteco.exe
4800	pwyrqtqlzgi.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	pwyrqtqlzgi.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xjftnupbyiubzdln = "erodygcpnyltsxgjk.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "nbzplurfeqenntdhjh.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbzplurfeqenntdhjh.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "nbzplurfeqenntdhjh.exe ."	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ynmdakixxkzjkrchkjy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "nbzplurfeqenntdhjh.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ynmdakixxkzjkrchkjy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erodygcpnyltsxgjk.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "ynmdakixxkzjkrchkjy.exe ."	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbzplurfeqenntdhjh.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "nbzplurfeqenntdhjh.exe ."	yboteco.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "xjftnupbyiubzdln.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ynmdakixxkzjkrchkjy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "erodygcpnyltsxgjk.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erodygcpnyltsxgjk.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lbbtrcbrsgwhjrdjnndd.exe ."	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xjftnupbyiubzdln = "nbzplurfeqenntdhjh.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xjftnupbyiubzdln = "ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbzplurfeqenntdhjh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynmdakixxkzjkrchkjy.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbzplurfeqenntdhjh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe ."	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "arslkwwnpevhktgnstkle.exe ."	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ynmdakixxkzjkrchkjy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xjftnupbyiubzdln.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xjftnupbyiubzdln.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "lbbtrcbrsgwhjrdjnndd.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "ynmdakixxkzjkrchkjy.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbzplurfeqenntdhjh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lbbtrcbrsgwhjrdjnndd.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ynmdakixxkzjkrchkjy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lbbtrcbrsgwhjrdjnndd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "lbbtrcbrsgwhjrdjnndd.exe ."	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe ."	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xjftnupbyiubzdln = "arslkwwnpevhktgnstkle.exe"	yboteco.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbzplurfeqenntdhjh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynmdakixxkzjkrchkjy.exe ."	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lbbtrcbrsgwhjrdjnndd.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ynmdakixxkzjkrchkjy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbzplurfeqenntdhjh.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xjftnupbyiubzdln.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xjftnupbyiubzdln = "erodygcpnyltsxgjk.exe"	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "xjftnupbyiubzdln.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "xjftnupbyiubzdln.exe"	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xjftnupbyiubzdln = "erodygcpnyltsxgjk.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynmdakixxkzjkrchkjy.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "nbzplurfeqenntdhjh.exe ."	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xjftnupbyiubzdln = "xjftnupbyiubzdln.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "arslkwwnpevhktgnstkle.exe"	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "lbbtrcbrsgwhjrdjnndd.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "lbbtrcbrsgwhjrdjnndd.exe ."	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erodygcpnyltsxgjk.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "erodygcpnyltsxgjk.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "lbbtrcbrsgwhjrdjnndd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\erodygcpnyltsxgjk = "nbzplurfeqenntdhjh.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbzplurfeqenntdhjh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nbzplurfeqenntdhjh.exe ."	pwyrqtqlzgi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yboteco.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arslkwwnpevhktgnstkle.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "xjftnupbyiubzdln.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pztfxcvfaisxtv = "erodygcpnyltsxgjk.exe ."	yboteco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxqbswoxryhlg = "arslkwwnpevhktgnstkle.exe"	yboteco.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yboteco.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yboteco.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	whatismyip.everdot.org
32	whatismyip.everdot.org
33	whatismyipaddress.com
47	whatismyip.everdot.org
55	whatismyip.everdot.org
15	www.showmyipaddress.com

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	yboteco.exe
File opened for modification	C:\autorun.inf	yboteco.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\erodygcpnyltsxgjk.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\nbzplurfeqenntdhjh.exe	pwyrqtqlzgi.exe
File created	C:\Windows\SysWOW64\cxczcswrxqlbivmxglgli.bfa	yboteco.exe
File created	C:\Windows\SysWOW64\xdtbpqflcgmnfdfbvlrhpdetzquabtrt.jzf	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\nbzplurfeqenntdhjh.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\ynmdakixxkzjkrchkjy.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\erodygcpnyltsxgjk.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\xdtbpqflcgmnfdfbvlrhpdetzquabtrt.jzf	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\rjlffstloewjnxltzbtvpp.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\cxczcswrxqlbivmxglgli.bfa	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\rjlffstloewjnxltzbtvpp.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\erodygcpnyltsxgjk.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\ynmdakixxkzjkrchkjy.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\xjftnupbyiubzdln.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\ynmdakixxkzjkrchkjy.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\ynmdakixxkzjkrchkjy.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\rjlffstloewjnxltzbtvpp.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\arslkwwnpevhktgnstkle.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\arslkwwnpevhktgnstkle.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\xjftnupbyiubzdln.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\nbzplurfeqenntdhjh.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\nbzplurfeqenntdhjh.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\arslkwwnpevhktgnstkle.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\lbbtrcbrsgwhjrdjnndd.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\xjftnupbyiubzdln.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\arslkwwnpevhktgnstkle.exe	yboteco.exe
File opened for modification	C:\Windows\SysWOW64\xjftnupbyiubzdln.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\lbbtrcbrsgwhjrdjnndd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\erodygcpnyltsxgjk.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\lbbtrcbrsgwhjrdjnndd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\rjlffstloewjnxltzbtvpp.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\lbbtrcbrsgwhjrdjnndd.exe	yboteco.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\cxczcswrxqlbivmxglgli.bfa	yboteco.exe
File created	C:\Program Files (x86)\cxczcswrxqlbivmxglgli.bfa	yboteco.exe
File opened for modification	C:\Program Files (x86)\xdtbpqflcgmnfdfbvlrhpdetzquabtrt.jzf	yboteco.exe
File created	C:\Program Files (x86)\xdtbpqflcgmnfdfbvlrhpdetzquabtrt.jzf	yboteco.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rjlffstloewjnxltzbtvpp.exe	yboteco.exe
File opened for modification	C:\Windows\cxczcswrxqlbivmxglgli.bfa	yboteco.exe
File opened for modification	C:\Windows\nbzplurfeqenntdhjh.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\xjftnupbyiubzdln.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\nbzplurfeqenntdhjh.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\ynmdakixxkzjkrchkjy.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\xjftnupbyiubzdln.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\erodygcpnyltsxgjk.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\erodygcpnyltsxgjk.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\rjlffstloewjnxltzbtvpp.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\ynmdakixxkzjkrchkjy.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\lbbtrcbrsgwhjrdjnndd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\arslkwwnpevhktgnstkle.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\ynmdakixxkzjkrchkjy.exe	yboteco.exe
File opened for modification	C:\Windows\rjlffstloewjnxltzbtvpp.exe	yboteco.exe
File opened for modification	C:\Windows\nbzplurfeqenntdhjh.exe	yboteco.exe
File opened for modification	C:\Windows\xjftnupbyiubzdln.exe	yboteco.exe
File opened for modification	C:\Windows\erodygcpnyltsxgjk.exe	yboteco.exe
File opened for modification	C:\Windows\arslkwwnpevhktgnstkle.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\lbbtrcbrsgwhjrdjnndd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\lbbtrcbrsgwhjrdjnndd.exe	yboteco.exe
File opened for modification	C:\Windows\arslkwwnpevhktgnstkle.exe	yboteco.exe
File opened for modification	C:\Windows\lbbtrcbrsgwhjrdjnndd.exe	yboteco.exe
File opened for modification	C:\Windows\arslkwwnpevhktgnstkle.exe	yboteco.exe
File created	C:\Windows\xdtbpqflcgmnfdfbvlrhpdetzquabtrt.jzf	yboteco.exe
File opened for modification	C:\Windows\xjftnupbyiubzdln.exe	yboteco.exe
File opened for modification	C:\Windows\nbzplurfeqenntdhjh.exe	yboteco.exe
File created	C:\Windows\cxczcswrxqlbivmxglgli.bfa	yboteco.exe
File opened for modification	C:\Windows\xdtbpqflcgmnfdfbvlrhpdetzquabtrt.jzf	yboteco.exe
File opened for modification	C:\Windows\rjlffstloewjnxltzbtvpp.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\erodygcpnyltsxgjk.exe	yboteco.exe
File opened for modification	C:\Windows\ynmdakixxkzjkrchkjy.exe	yboteco.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
5032	yboteco.exe
5032	yboteco.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
5032	yboteco.exe
5032	yboteco.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	yboteco.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2608	1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	82
PID 1316 wrote to memory of 2608	1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	82
PID 1316 wrote to memory of 2608	1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	82
PID 2608 wrote to memory of 5032	2608	pwyrqtqlzgi.exe	86
PID 2608 wrote to memory of 5032	2608	pwyrqtqlzgi.exe	86
PID 2608 wrote to memory of 5032	2608	pwyrqtqlzgi.exe	86
PID 2608 wrote to memory of 312	2608	pwyrqtqlzgi.exe	87
PID 2608 wrote to memory of 312	2608	pwyrqtqlzgi.exe	87
PID 2608 wrote to memory of 312	2608	pwyrqtqlzgi.exe	87
PID 1316 wrote to memory of 4800	1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	93
PID 1316 wrote to memory of 4800	1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	93
PID 1316 wrote to memory of 4800	1316	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	93

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yboteco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yboteco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe

C:\Users\Admin\AppData\Local\Temp\8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
"C:\Users\Admin\AppData\Local\Temp\8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\yboteco.exe
    "C:\Users\Admin\AppData\Local\Temp\yboteco.exe" "-C:\Users\Admin\AppData\Local\Temp\xjftnupbyiubzdln.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\yboteco.exe
    "C:\Users\Admin\AppData\Local\Temp\yboteco.exe" "-C:\Users\Admin\AppData\Local\Temp\xjftnupbyiubzdln.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:312
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\arslkwwnpevhktgnstkle.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\erodygcpnyltsxgjk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\lbbtrcbrsgwhjrdjnndd.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nbzplurfeqenntdhjh.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
ff59b1f4c73493d7aafe202ac8ba0446

SHA1
8e5977f2d0407ba12f1fe62fad950ae5e9f46d3e

SHA256
7af7d5a2aa7324923d556a7d4b42de561269c874947eef50ec6b26f6f56a4497

SHA512
d3e36263db7bbffe8ced8134662816d88259501ef398e1bfd9d910a978b7bc9e091a8a8194f400324d0214a79fa45409780c0a1d6414e9dc20021665d7e2d24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
ff59b1f4c73493d7aafe202ac8ba0446

SHA1
8e5977f2d0407ba12f1fe62fad950ae5e9f46d3e

SHA256
7af7d5a2aa7324923d556a7d4b42de561269c874947eef50ec6b26f6f56a4497

SHA512
d3e36263db7bbffe8ced8134662816d88259501ef398e1bfd9d910a978b7bc9e091a8a8194f400324d0214a79fa45409780c0a1d6414e9dc20021665d7e2d24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
ff59b1f4c73493d7aafe202ac8ba0446

SHA1
8e5977f2d0407ba12f1fe62fad950ae5e9f46d3e

SHA256
7af7d5a2aa7324923d556a7d4b42de561269c874947eef50ec6b26f6f56a4497

SHA512
d3e36263db7bbffe8ced8134662816d88259501ef398e1bfd9d910a978b7bc9e091a8a8194f400324d0214a79fa45409780c0a1d6414e9dc20021665d7e2d24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjlffstloewjnxltzbtvpp.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjftnupbyiubzdln.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\yboteco.exe

Filesize
736KB

MD5
105c7d8b8593151cf8b151b752f17e32

SHA1
d8fcb098c71e18c40776afa19728432594d17c30

SHA256
7eb49f4053a84c15a510e422379f15020d02a18f9927b11c4b2506921f48213c

SHA512
26309d4aeba468d9e2a28fffa53f19004927912b32611a14bc093e1d8784c6f6caa6d3f9caaf8f6233150af8a2d26a45acafd69070c157aeece5f2b5b505d714

Download Submit
C:\Users\Admin\AppData\Local\Temp\yboteco.exe

Filesize
736KB

MD5
105c7d8b8593151cf8b151b752f17e32

SHA1
d8fcb098c71e18c40776afa19728432594d17c30

SHA256
7eb49f4053a84c15a510e422379f15020d02a18f9927b11c4b2506921f48213c

SHA512
26309d4aeba468d9e2a28fffa53f19004927912b32611a14bc093e1d8784c6f6caa6d3f9caaf8f6233150af8a2d26a45acafd69070c157aeece5f2b5b505d714

Download Submit
C:\Users\Admin\AppData\Local\Temp\yboteco.exe

Filesize
736KB

MD5
105c7d8b8593151cf8b151b752f17e32

SHA1
d8fcb098c71e18c40776afa19728432594d17c30

SHA256
7eb49f4053a84c15a510e422379f15020d02a18f9927b11c4b2506921f48213c

SHA512
26309d4aeba468d9e2a28fffa53f19004927912b32611a14bc093e1d8784c6f6caa6d3f9caaf8f6233150af8a2d26a45acafd69070c157aeece5f2b5b505d714

Download Submit
C:\Users\Admin\AppData\Local\Temp\ynmdakixxkzjkrchkjy.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\arslkwwnpevhktgnstkle.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\erodygcpnyltsxgjk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\lbbtrcbrsgwhjrdjnndd.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\nbzplurfeqenntdhjh.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\rjlffstloewjnxltzbtvpp.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\xjftnupbyiubzdln.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\ynmdakixxkzjkrchkjy.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\arslkwwnpevhktgnstkle.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\arslkwwnpevhktgnstkle.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\arslkwwnpevhktgnstkle.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\erodygcpnyltsxgjk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\erodygcpnyltsxgjk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\erodygcpnyltsxgjk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\lbbtrcbrsgwhjrdjnndd.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\lbbtrcbrsgwhjrdjnndd.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\lbbtrcbrsgwhjrdjnndd.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\nbzplurfeqenntdhjh.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\nbzplurfeqenntdhjh.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\nbzplurfeqenntdhjh.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\rjlffstloewjnxltzbtvpp.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\rjlffstloewjnxltzbtvpp.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\rjlffstloewjnxltzbtvpp.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\xjftnupbyiubzdln.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\xjftnupbyiubzdln.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\xjftnupbyiubzdln.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\ynmdakixxkzjkrchkjy.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\ynmdakixxkzjkrchkjy.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\ynmdakixxkzjkrchkjy.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit