Overview
overview
10Static
static
10Endermanch...is.exe
windows7-x64
1Endermanch...is.exe
windows10-2004-x64
Endermanch...ug.exe
windows7-x64
6Endermanch...ug.exe
windows10-2004-x64
6Endermanch...ck.exe
windows7-x64
7Endermanch...ck.exe
windows10-2004-x64
7Endermanch...om.exe
windows7-x64
1Endermanch...om.exe
windows10-2004-x64
1Endermanch...le.exe
windows7-x64
1Endermanch...le.exe
windows10-2004-x64
1Endermanch...er.exe
windows7-x64
7Endermanch...er.exe
windows10-2004-x64
7Endermanch...er.exe
windows7-x64
7Endermanch...er.exe
windows10-2004-x64
7Endermanch...er.exe
windows7-x64
Endermanch...er.exe
windows10-2004-x64
Endermanch...us.exe
windows7-x64
1Endermanch...us.exe
windows10-2004-x64
1Endermanch....C.exe
windows7-x64
10Endermanch....C.exe
windows10-2004-x64
10Endermanch...rd.exe
windows7-x64
10Endermanch...rd.exe
windows10-2004-x64
9Endermanch...a2.exe
windows7-x64
1Endermanch...a2.exe
windows10-2004-x64
1Endermanch...19.exe
windows7-x64
7Endermanch...19.exe
windows10-2004-x64
7Endermanch...eg.exe
windows7-x64
7Endermanch...eg.exe
windows10-2004-x64
3Endermanch...1).exe
windows7-x64
3Endermanch...1).exe
windows10-2004-x64
3Endermanch...ld.exe
windows7-x64
3Endermanch...ld.exe
windows10-2004-x64
3Resubmissions
10-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2023 06:25
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@CleanThis.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Endermanch@CleanThis.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Endermanch@ColorBug.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Endermanch@ColorBug.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Endermanch@DeriaLock.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Endermanch@DeriaLock.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Endermanch@Deskbottom.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Endermanch@Deskbottom.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Endermanch@DesktopPuzzle.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
Endermanch@DesktopPuzzle.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Endermanch@HMBlocker.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
Endermanch@HMBlocker.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Endermanch@HappyAntivirus.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
Endermanch@HappyAntivirus.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Endermanch@Illerka.C.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
Endermanch@Illerka.C.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
Endermanch@Koteyka2.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
Endermanch@Koteyka2.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
Endermanch@LPS2019.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
Endermanch@LPS2019.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
Endermanch@Movie.mpeg.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
Endermanch@Movie.mpeg.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
Endermanch@NavaShield(1).exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
Endermanch@NavaShield(1).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
Endermanch@NavaShield.exe
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
Endermanch@NavaShield.exe
Resource
win10v2004-20230703-en
General
-
Target
Endermanch@FreeYoutubeDownloader.exe
-
Size
396KB
-
MD5
13f4b868603cf0dd6c32702d1bd858c9
-
SHA1
a595ab75e134f5616679be5f11deefdfaae1de15
-
SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
-
SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
-
SSDEEP
12288:jANwRo+mv8QD4+0V16nkFkkk2kyW9EArjaccoH0qzh4:jAT8QE+kHW9EAr+fr4i
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Endermanch@FreeYoutubeDownloader.exeFree YouTube Downloader.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation Endermanch@FreeYoutubeDownloader.exe Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation Free YouTube Downloader.exe -
Executes dropped EXE 2 IoCs
Processes:
Free YouTube Downloader.exeBox.exepid process 3816 Free YouTube Downloader.exe 2720 Box.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Endermanch@FreeYoutubeDownloader.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Endermanch@FreeYoutubeDownloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" Endermanch@FreeYoutubeDownloader.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 4 IoCs
Processes:
Endermanch@FreeYoutubeDownloader.exedescription ioc process File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe Endermanch@FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe Endermanch@FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe Endermanch@FreeYoutubeDownloader.exe File created C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini Endermanch@FreeYoutubeDownloader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Free YouTube Downloader.exepid process 3816 Free YouTube Downloader.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Free YouTube Downloader.exepid process 3816 Free YouTube Downloader.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Endermanch@FreeYoutubeDownloader.exeFree YouTube Downloader.exedescription pid process target process PID 3052 wrote to memory of 3816 3052 Endermanch@FreeYoutubeDownloader.exe Free YouTube Downloader.exe PID 3052 wrote to memory of 3816 3052 Endermanch@FreeYoutubeDownloader.exe Free YouTube Downloader.exe PID 3816 wrote to memory of 2720 3816 Free YouTube Downloader.exe Box.exe PID 3816 wrote to memory of 2720 3816 Free YouTube Downloader.exe Box.exe PID 3816 wrote to memory of 2720 3816 Free YouTube Downloader.exe Box.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@FreeYoutubeDownloader.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@FreeYoutubeDownloader.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exeFilesize
438KB
MD51bb4dd43a8aebc8f3b53acd05e31d5b5
SHA154cd1a4a505b301df636903b2293d995d560887e
SHA256a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02
SHA51294c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exeFilesize
438KB
MD51bb4dd43a8aebc8f3b53acd05e31d5b5
SHA154cd1a4a505b301df636903b2293d995d560887e
SHA256a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02
SHA51294c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exeFilesize
153KB
MD5f33a4e991a11baf336a2324f700d874d
SHA19da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA256a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
SHA512edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exeFilesize
153KB
MD5f33a4e991a11baf336a2324f700d874d
SHA19da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA256a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
SHA512edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exeFilesize
153KB
MD5f33a4e991a11baf336a2324f700d874d
SHA19da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA256a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
SHA512edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
-
memory/2720-177-0x0000000003010000-0x0000000003020000-memory.dmpFilesize
64KB
-
memory/2720-178-0x0000000003000000-0x000000000300A000-memory.dmpFilesize
40KB
-
memory/2720-182-0x0000000003010000-0x0000000003020000-memory.dmpFilesize
64KB
-
memory/2720-181-0x0000000003010000-0x0000000003020000-memory.dmpFilesize
64KB
-
memory/2720-180-0x0000000074B10000-0x00000000752C0000-memory.dmpFilesize
7.7MB
-
memory/2720-179-0x0000000003010000-0x0000000003020000-memory.dmpFilesize
64KB
-
memory/2720-173-0x00000000008E0000-0x0000000000954000-memory.dmpFilesize
464KB
-
memory/2720-174-0x0000000074B10000-0x00000000752C0000-memory.dmpFilesize
7.7MB
-
memory/2720-175-0x0000000005B30000-0x00000000060D4000-memory.dmpFilesize
5.6MB
-
memory/2720-176-0x00000000053F0000-0x0000000005482000-memory.dmpFilesize
584KB
-
memory/3052-165-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3816-168-0x000001C979630000-0x000001C979640000-memory.dmpFilesize
64KB
-
memory/3816-166-0x000001C95F130000-0x000001C95F15E000-memory.dmpFilesize
184KB
-
memory/3816-167-0x00007FF837B40000-0x00007FF838601000-memory.dmpFilesize
10.8MB
-
memory/3816-170-0x000001C979630000-0x000001C979640000-memory.dmpFilesize
64KB
-
memory/3816-169-0x00007FF837B40000-0x00007FF838601000-memory.dmpFilesize
10.8MB