Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
21-11-2023 01:28
General
-
Target
944650d3da8b81e951b69bf7572f3069eaa542eb8812d6d5785c9a5dc1e8820d.x.exe
-
Size
5.5MB
-
MD5
d7bafb9a979dd8d4398e49874b0658a0
-
SHA1
3bef518b3a2eae1fbc56aa5b464da7476ea7217d
-
SHA256
944650d3da8b81e951b69bf7572f3069eaa542eb8812d6d5785c9a5dc1e8820d
-
SHA512
3d6c755d63ab5afbb79161c83a39912270a086cb954ba59b91ad4231a8293c598c2f0d78735c9c2300ff9dcf8653ac0486b68ec4092cec0980b83c0713b619a1
-
SSDEEP
98304:9QqNNOWs0J5jnfZai4UZ0x+SKzHjn5jJujrqjne1uikKmkww91wjbLHbXpoq:9fN4W/rjhBhZ0Pmn5FpjniSI1ULHdN
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\944650d3da8b81e951b69bf7572f3069eaa542eb8812d6d5785c9a5dc1e8820d.x.exe"C:\Users\Admin\AppData\Local\Temp\944650d3da8b81e951b69bf7572f3069eaa542eb8812d6d5785c9a5dc1e8820d.x.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\Runn\Yloux.exe"C:\windows\Runn\Yloux.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\{2113BA9C-2D32-4950-AFC3-AF051E8E19BE}.exe"C:\Users\Admin\AppData\Local\Temp\{2113BA9C-2D32-4950-AFC3-AF051E8E19BE}.exe" /s "C:\Users\Admin\AppData\Local\Temp\\{E7B6AF26-F358-46b4-9DD8-581B590C05B9}"1⤵
- Executes dropped EXE
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ff0c7c2667dff4f3ed588f40d047c642
SHA11162c83bd0bb0d81b7ab7f616cb012b790aa4adf
SHA25602af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
SHA512539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
215B
MD56a1c3fecfd7165643a07b1348d3244b3
SHA10c3b8b1796487e7e1b037eb82d4f7929df4847e4
SHA256802a60cf636fefb93cebe548b9e397748a8e7bf618c219d035139def9f82a642
SHA512de042dc477775e022afb1440bc2c24f26a7c50c29de1e523a92b1a01cd5308db327b7aa9a80ab6fd37b94632a835d37da045cd78fbb6090275f1778a38252521
-
Filesize
324KB
MD5f64170c793fb8568738cfd1857783a9d
SHA17f1acc4459e99996f025896894d697b7c2f0b84d
SHA2564928635e712fdfd584eb5d25278e42e69eb7ab6c12bc3c1fca95a0f71692c33d
SHA5123059de955d256c098a84e71d04a31e81eeac8c2893971fabe8d4e18f0986241460911f455d00f5693720bc13c0edbe3c421d7f88788bc10027a75cf97a13b218
-
Filesize
378KB
MD55a189470b11373b448bace9315c0f6ac
SHA1add6f55b32662ace0599c28230fcc8b0f6f1042f
SHA256f6b365099879bf8eee77206451634992da91e76c69606ccfcbc12a927c02873a
SHA5126f0d8b3ad532bf22045cbb3362355711ce7c6d2a09c5b546572084eda12c0fab31d7fdd1f3ff22d016108f1ca5aa1b4ceefd2e5f904bf4d96cfc3291ac9dc09e
-
Filesize
324KB
MD5f64170c793fb8568738cfd1857783a9d
SHA17f1acc4459e99996f025896894d697b7c2f0b84d
SHA2564928635e712fdfd584eb5d25278e42e69eb7ab6c12bc3c1fca95a0f71692c33d
SHA5123059de955d256c098a84e71d04a31e81eeac8c2893971fabe8d4e18f0986241460911f455d00f5693720bc13c0edbe3c421d7f88788bc10027a75cf97a13b218
-
Filesize
1.0MB
MD5217dc98e219a340cb09915244c992a52
SHA1a04f101ca7180955d62e4a1aaeccdcca489209da
SHA25627c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85
-
Filesize
324KB
MD5f64170c793fb8568738cfd1857783a9d
SHA17f1acc4459e99996f025896894d697b7c2f0b84d
SHA2564928635e712fdfd584eb5d25278e42e69eb7ab6c12bc3c1fca95a0f71692c33d
SHA5123059de955d256c098a84e71d04a31e81eeac8c2893971fabe8d4e18f0986241460911f455d00f5693720bc13c0edbe3c421d7f88788bc10027a75cf97a13b218
-
Filesize
8.7MB
-
Filesize
3.5MB
-
Filesize
8.7MB
-
Filesize
3.5MB
-
Filesize
8.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
332KB
-
Filesize
408KB
-
Filesize
240KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
264KB