322787eaae64efff2b1a5fc2e8d7f4b9b1ad44fb075cf082ade1b2a7c5ded76e

Resubmissions

05/01/2023, 10:35

230105-mm6v8sbf7610

12/12/2022, 12:09

221212-pbfk1sbc738

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2022, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yuki4onna.exe
Size 5.8MB
Sample221212-pbfk1sbc73
SHA256 322787eaae64efff2b1a5fc2e8d7f4b9b1ad44fb075cf082ade1b2a7c5ded76e
MD5 6bdd7747ce0c482573958130ca93d1ef
SHA1 e6c5e9ea9a0634722d2842d274870d8ceff7ff43
SHA512 fa2dcb54c8543b3a0fe306a14f9b40700f6bef6410fee60aedd69a6b18ea43b7bbf5f63d1f96db4dcd05a4db7461148f5970a27fb128d78d04a55aac21536b23
SSDEEP 98304:Bs4j1PRaSQasZMIJblDH4Mdf4HTNCxbKj4v2ol6LmXg717+uqivWzC3tO4JNxlfI:VPRiasqIhlLfdoT80ZD622itz9F4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1636	gkoOrBZfiT.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4900	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	88	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1932	yuki4onna.exe
1932	yuki4onna.exe
1636	gkoOrBZfiT.exe
1636	gkoOrBZfiT.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4908	1932	yuki4onna.exe	80
PID 1932 wrote to memory of 4908	1932	yuki4onna.exe	80
PID 1932 wrote to memory of 4908	1932	yuki4onna.exe	80
PID 4908 wrote to memory of 4900	4908	cmd.exe	82
PID 4908 wrote to memory of 4900	4908	cmd.exe	82
PID 4908 wrote to memory of 4900	4908	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\yuki4onna.exe
"C:\Users\Admin\AppData\Local\Temp\yuki4onna.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn uAFexqRNTm /tr C:\Users\Admin\AppData\Roaming\uAFexqRNTm\gkoOrBZfiT.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn uAFexqRNTm /tr C:\Users\Admin\AppData\Roaming\uAFexqRNTm\gkoOrBZfiT.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:4900

C:\Users\Admin\AppData\Roaming\uAFexqRNTm\gkoOrBZfiT.exe
C:\Users\Admin\AppData\Roaming\uAFexqRNTm\gkoOrBZfiT.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gkoOrBZfiT.exe

Path C:\Users\Admin\AppData\Roaming\uAFexqRNTm\gkoOrBZfiT.exe
Size 684.1MB
SHA256 fe8cd10381494e79beb6b9d5fb20b053b3eb33651132c3f5718802096923ea00
MD5 5aeb9e9621053533e38d1d598683e161
SHA1 8788fcefbfd34b208677ee8b6cc69a9c8472484c
SHA512 694df29de5d3c85ea4929ed35303aa87d6731f6c4eabc28b7d5a4062bf75bd86cde88c5cb777778517e676f271ec4baa0e9427dc08d7eb434acd0f3c553e41f5
SSDEEP 12582912:klzsMtNZcDJzXHDViAnEppegzBn8VcOeEwBP53X4Ltux2mMZH:Mzs4NO5HpiOEppt8VcbOU2me
MD5 SHA1 SHA512 SSDEEP

Submit Download

gkoOrBZfiT.exe

Path C:\Users\Admin\AppData\Roaming\uAFexqRNTm\gkoOrBZfiT.exe
Size 684.1MB
SHA256 fe8cd10381494e79beb6b9d5fb20b053b3eb33651132c3f5718802096923ea00
MD5 5aeb9e9621053533e38d1d598683e161
SHA1 8788fcefbfd34b208677ee8b6cc69a9c8472484c
SHA512 694df29de5d3c85ea4929ed35303aa87d6731f6c4eabc28b7d5a4062bf75bd86cde88c5cb777778517e676f271ec4baa0e9427dc08d7eb434acd0f3c553e41f5
SSDEEP 12582912:klzsMtNZcDJzXHDViAnEppegzBn8VcOeEwBP53X4Ltux2mMZH:Mzs4NO5HpiOEppt8VcbOU2me
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1636-142-0x0000000000440000-0x00000000010A9000-memory.dmp

Download

memory/1636-146-0x0000000000440000-0x00000000010A9000-memory.dmp

Download

memory/1932-132-0x0000000000FE0000-0x0000000001C49000-memory.dmp

Download

memory/1932-136-0x0000000000FE0000-0x0000000001C49000-memory.dmp

Download

memory/1932-139-0x0000000000FE0000-0x0000000001C49000-memory.dmp

Download