Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 11:28

General

  • Target

    a6358a4a0c6efc2c466d23d52e2b2f989cbb2f30016c76c9569508dd45dbd3de.exe

  • Size

    5.4MB

  • MD5

    cdf202517072460da0f60de563501961

  • SHA1

    0fd1d45bcd92adb8828bc1b2ca6551f672f2ee4d

  • SHA256

    a6358a4a0c6efc2c466d23d52e2b2f989cbb2f30016c76c9569508dd45dbd3de

  • SHA512

    c33e5073064ac4d80bb82ad55f89c1020205ad571075dd5b0a8045d9334993c604720749bf4824e754552521c0809ee050c3b74dac09b75cdb5e2f3d61596846

  • SSDEEP

    98304:LW++hEZw5I/iyjVtLNHxDtdkOydIt1sBCJF7xBPyVyPCDxYWbE4WBZ2csxVhLs:L6Eriet5HxDtdW61sB6VuwPCDxYZYxVR

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6358a4a0c6efc2c466d23d52e2b2f989cbb2f30016c76c9569508dd45dbd3de.exe
    "C:\Users\Admin\AppData\Local\Temp\a6358a4a0c6efc2c466d23d52e2b2f989cbb2f30016c76c9569508dd45dbd3de.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:180
    • C:\windows\Runn\Yloux.exe
      "C:\windows\Runn\Yloux.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2964
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:740

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\Runn\Yloux.exe

            Filesize

            325KB

            MD5

            fff86732dd49317db08c940f362f5023

            SHA1

            79e1ff08ccde6ea37cf84617e2ada8e86672730e

            SHA256

            ed4719202f1d434071516ab5aafb9b6f3080be77e4bfeecfa85af68dfc1d28f0

            SHA512

            e43089ba588e5eaa1007d176551710ebedd8f855c900c1248747d2172eceb8214e5c4bcc6e7a7bcf3d58fbffc306ae33e3c89e315bedde9f2152acaf22a092b9

          • C:\Windows\Runn\Yloux.exe

            Filesize

            325KB

            MD5

            fff86732dd49317db08c940f362f5023

            SHA1

            79e1ff08ccde6ea37cf84617e2ada8e86672730e

            SHA256

            ed4719202f1d434071516ab5aafb9b6f3080be77e4bfeecfa85af68dfc1d28f0

            SHA512

            e43089ba588e5eaa1007d176551710ebedd8f855c900c1248747d2172eceb8214e5c4bcc6e7a7bcf3d58fbffc306ae33e3c89e315bedde9f2152acaf22a092b9

          • C:\windows\Runn\1.bin

            Filesize

            176KB

            MD5

            e8d22da772001f5b8e4036d8c0673e5f

            SHA1

            2dd5d03dad6e75e3c082b774a31a35ef7775a6cf

            SHA256

            98de66877090c3d1b3ac1c2e732bccd9f271eaf4487cb6b2803da8eb0cbbb447

            SHA512

            62ccedcedb86bd8e7afebdb0de2b60db2c9fbe56040874f001d5b74529c9f998061bce03058f362952a069435f6c42e0b361865daa2f32116ff6369b0852df10

          • C:\windows\Runn\Yloux.exe

            Filesize

            325KB

            MD5

            fff86732dd49317db08c940f362f5023

            SHA1

            79e1ff08ccde6ea37cf84617e2ada8e86672730e

            SHA256

            ed4719202f1d434071516ab5aafb9b6f3080be77e4bfeecfa85af68dfc1d28f0

            SHA512

            e43089ba588e5eaa1007d176551710ebedd8f855c900c1248747d2172eceb8214e5c4bcc6e7a7bcf3d58fbffc306ae33e3c89e315bedde9f2152acaf22a092b9

          • memory/180-43-0x00000000000D0000-0x0000000000965000-memory.dmp

            Filesize

            8.6MB

          • memory/180-1-0x00000000000D0000-0x0000000000965000-memory.dmp

            Filesize

            8.6MB

          • memory/180-3-0x00000000000D0000-0x0000000000965000-memory.dmp

            Filesize

            8.6MB

          • memory/180-5-0x0000000003530000-0x0000000003880000-memory.dmp

            Filesize

            3.3MB

          • memory/180-6-0x0000000010000000-0x0000000010354000-memory.dmp

            Filesize

            3.3MB

          • memory/180-0-0x0000000001310000-0x0000000001311000-memory.dmp

            Filesize

            4KB

          • memory/2964-47-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-53-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-38-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-44-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-45-0x0000000000400000-0x0000000000453000-memory.dmp

            Filesize

            332KB

          • memory/2964-46-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-32-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-48-0x0000000002C20000-0x0000000002C5E000-memory.dmp

            Filesize

            248KB

          • memory/2964-50-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-51-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-52-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-39-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-27-0x00000000000C0000-0x00000000000ED000-memory.dmp

            Filesize

            180KB

          • memory/2964-57-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-59-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-60-0x0000000004BE0000-0x0000000004C5F000-memory.dmp

            Filesize

            508KB

          • memory/2964-74-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-75-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-77-0x0000000180000000-0x0000000180033000-memory.dmp

            Filesize

            204KB

          • memory/2964-78-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-80-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-86-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB

          • memory/2964-87-0x0000000002E60000-0x0000000002EA4000-memory.dmp

            Filesize

            272KB