Analysis
-
max time kernel
179s -
max time network
218s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
11/11/2023, 13:47
General
-
Target
2744ee22053b9e8b2189f58be6f1b7f2dfd1e7515d831168d733c149788153f2.exe
-
Size
5.4MB
-
MD5
c1aea0eb312aa84403059dad41768624
-
SHA1
5e5629028375e0ce6cfa803dfbfe77ab6534395d
-
SHA256
2744ee22053b9e8b2189f58be6f1b7f2dfd1e7515d831168d733c149788153f2
-
SHA512
494ed13b832133c717651acf1a5533cb8ba76ff893f7eadd0f492572037d1be41510f532e8a2efa18dcefe0bc7bbdc4655756d99b6c68f384bfda3ee75c38d3e
-
SSDEEP
98304:HdPFf4k/ErSZKmxN3l9slFgx4HBDeSPn/IkJJMinZ1iAFYG8uL:Hdtf4wQgN1bx4HBDeSokJ2inZ17FzL
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2744ee22053b9e8b2189f58be6f1b7f2dfd1e7515d831168d733c149788153f2.exe"C:\Users\Admin\AppData\Local\Temp\2744ee22053b9e8b2189f58be6f1b7f2dfd1e7515d831168d733c149788153f2.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\Runn\Yloux.exe"C:\windows\Runn\Yloux.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\{3A151204-958B-4cb6-8A20-1F19B3D7C9EB}.exe"C:\Users\Admin\AppData\Local\Temp\{3A151204-958B-4cb6-8A20-1F19B3D7C9EB}.exe" /s "C:\Users\Admin\AppData\Local\Temp\\{8BFA6E53-2A93-4294-9CAB-F07052BE504E}"1⤵
- Executes dropped EXE
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ff0c7c2667dff4f3ed588f40d047c642
SHA11162c83bd0bb0d81b7ab7f616cb012b790aa4adf
SHA25602af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
SHA512539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3
-
Filesize
2KB
MD5ff0c7c2667dff4f3ed588f40d047c642
SHA11162c83bd0bb0d81b7ab7f616cb012b790aa4adf
SHA25602af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
SHA512539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
335KB
MD504df97d03e04be2564d2840cc38b8972
SHA15288fb5c2e6e187348a392b565c3d73552131490
SHA25678a52dda357dfc0d26a5bc5abdde97b46439fcd6cb0d9d2a0bb5c51fef6b23ce
SHA512771357d49980b0ff665fd5086861c27edc4f70b9b5e26bd9d467e7f93bda5abef32aebcc72b06c37141693304464fbf11f3ea5fab7a8f57c058cce036aed8b95
-
Filesize
176KB
MD5758d06af8e7717885864e76d2dcabdf5
SHA1d1b40373854f40eebf9c445c6e1a6143d56a0d4b
SHA2566844de58de61e2c3cb67706f3dbb91d0d245c64740c7d139517fc0b335183b7e
SHA512499702f7aff6b63195af1d234648dd4814fe7a099ddbad177ade49d1f4aa0926ed5cce7a7369f8a7f480c20957b52416184deb5d85290e70f326875bb8503e23
-
Filesize
335KB
MD504df97d03e04be2564d2840cc38b8972
SHA15288fb5c2e6e187348a392b565c3d73552131490
SHA25678a52dda357dfc0d26a5bc5abdde97b46439fcd6cb0d9d2a0bb5c51fef6b23ce
SHA512771357d49980b0ff665fd5086861c27edc4f70b9b5e26bd9d467e7f93bda5abef32aebcc72b06c37141693304464fbf11f3ea5fab7a8f57c058cce036aed8b95
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
335KB
MD504df97d03e04be2564d2840cc38b8972
SHA15288fb5c2e6e187348a392b565c3d73552131490
SHA25678a52dda357dfc0d26a5bc5abdde97b46439fcd6cb0d9d2a0bb5c51fef6b23ce
SHA512771357d49980b0ff665fd5086861c27edc4f70b9b5e26bd9d467e7f93bda5abef32aebcc72b06c37141693304464fbf11f3ea5fab7a8f57c058cce036aed8b95
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
248KB
-
Filesize
344KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
180KB
-
Filesize
272KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
272KB