Analysis
- max time kernel
151s - max time network
126s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
11/01/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Yeezus.rar
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Yeezus.rar
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
InjectionLibrary.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
InjectionLibrary.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
ReaLTaiizor.dll
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ReaLTaiizor.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Yeezus.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
- Target Yeezus.exe
- Size 8.3MB
- Sample240111-retcdshcdj
- SHA256 a32ad6995d0a15c0b85485b36a92385f866fd119eb5a2678403f8201bb89e18c
- MD5 fcb147a5c323be1cd6341d87ee9eae35
- SHA1 9ae4d2552158126efe96e7d9b92e782354bafefc
- SHA512 677156c85daf561398eef97e1e920c66cccfd342988d318b292d03694eac0b1a594adfbb7c3b5ac940234d2c165504fe1ff8dcd168ab14c49c63a0dbdca940f8
- SSDEEP 196608:e64kbezidoC+okKRXDFk81sgJ2nMwDeCfLjtDwh31rnA4a9Tl:lbJdx+eDFk81sg4nMYjjto3o/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral7/memory/1172-6-0x0000000007A00000-0x0000000007F74000-memory.dmp family_umbral - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1172 Yeezus.exe 1172 Yeezus.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1172 Yeezus.exe