Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2023, 05:28

General

  • Target

    b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe

  • Size

    5.4MB

  • MD5

    e16899ad557215c7af9942c93ad0b5c5

  • SHA1

    89939d6c77c59b13287a74fbc73092e1b66c15ab

  • SHA256

    b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301

  • SHA512

    4342b3a16d4803ee2e0300ef9484e5b11fc5f0c310da501c50d1eb2a5e19ff0ae0402306dc02828702432877f41fffdcd8df4c00a43224937bd839084adce0bb

  • SSDEEP

    98304:+wGRS5ao3FxD1jdn0qEUiSinZXI3/Gjb2nGcMqvmZVV3sdfhhT:+wFQE5ZnXgSint0YbRcKOdfPT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe
    "C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\windows\Runn\Yloux.exe
      "C:\windows\Runn\Yloux.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3036

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Runn\Yloux.exe

          Filesize

          3.0MB

          MD5

          8eb8324b0edbf91fdc49ec66e0248959

          SHA1

          5c98914ce7b5c564db4456320b89428f8b6d83aa

          SHA256

          c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a

          SHA512

          5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

        • C:\windows\Runn\1.bin

          Filesize

          176KB

          MD5

          7e9d02bca3ab745c84117057f48b1a97

          SHA1

          b17986a21b44749f042f4bf779c9b75ab7bce5bf

          SHA256

          a3cd7777c4344f0c80140d2cdfce1b993a8653707de8a68490bfcc6fbfc63c1f

          SHA512

          edfb1cff6736f4ebf5675c9d54039e036201715b89fe2233e790a7cb1796b10fb7c1016f305f13742427baae627c1f7bd32b43c0c8d9d7d7fda4440a4b9fefae

        • C:\windows\Runn\Yloux.exe

          Filesize

          3.0MB

          MD5

          8eb8324b0edbf91fdc49ec66e0248959

          SHA1

          5c98914ce7b5c564db4456320b89428f8b6d83aa

          SHA256

          c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a

          SHA512

          5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

        • \Windows\Runn\Yloux.exe

          Filesize

          3.0MB

          MD5

          8eb8324b0edbf91fdc49ec66e0248959

          SHA1

          5c98914ce7b5c564db4456320b89428f8b6d83aa

          SHA256

          c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a

          SHA512

          5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

        • memory/2360-44-0x0000000000AE0000-0x000000000138A000-memory.dmp

          Filesize

          8.7MB

        • memory/2360-6-0x0000000000100000-0x0000000000101000-memory.dmp

          Filesize

          4KB

        • memory/2360-10-0x0000000003220000-0x0000000003821000-memory.dmp

          Filesize

          6.0MB

        • memory/2360-11-0x0000000010000000-0x0000000010606000-memory.dmp

          Filesize

          6.0MB

        • memory/2360-2-0x0000000000AE0000-0x000000000138A000-memory.dmp

          Filesize

          8.7MB

        • memory/2360-3-0x0000000000100000-0x0000000000101000-memory.dmp

          Filesize

          4KB

        • memory/2360-4-0x0000000000AE0000-0x000000000138A000-memory.dmp

          Filesize

          8.7MB

        • memory/2360-0-0x0000000000100000-0x0000000000101000-memory.dmp

          Filesize

          4KB

        • memory/2360-32-0x0000000000AE0000-0x000000000138A000-memory.dmp

          Filesize

          8.7MB

        • memory/2360-9-0x0000000077730000-0x0000000077731000-memory.dmp

          Filesize

          4KB

        • memory/3036-52-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-40-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-33-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-45-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-50-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-48-0x0000000000400000-0x0000000000591000-memory.dmp

          Filesize

          1.6MB

        • memory/3036-51-0x0000000000810000-0x000000000084E000-memory.dmp

          Filesize

          248KB

        • memory/3036-49-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-47-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-46-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-27-0x0000000000310000-0x000000000033D000-memory.dmp

          Filesize

          180KB

        • memory/3036-53-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-39-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-55-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-60-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-62-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-63-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/3036-64-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-70-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB

        • memory/3036-72-0x0000000000850000-0x0000000000894000-memory.dmp

          Filesize

          272KB