Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 14:06
Static task
static1
Behavioral task
behavioral1
Sample
Yeezus.rar
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
Yeezus.rar
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
InjectionLibrary.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
InjectionLibrary.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ReaLTaiizor.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
ReaLTaiizor.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Yeezus.exe
Resource
win7-20231215-en
windows7-x64
General
-
Target
Yeezus.exe
-
Size
8.3MB
-
MD5
fcb147a5c323be1cd6341d87ee9eae35
-
SHA1
9ae4d2552158126efe96e7d9b92e782354bafefc
-
SHA256
a32ad6995d0a15c0b85485b36a92385f866fd119eb5a2678403f8201bb89e18c
-
SHA512
677156c85daf561398eef97e1e920c66cccfd342988d318b292d03694eac0b1a594adfbb7c3b5ac940234d2c165504fe1ff8dcd168ab14c49c63a0dbdca940f8
-
SSDEEP
196608:e64kbezidoC+okKRXDFk81sgJ2nMwDeCfLjtDwh31rnA4a9Tl:lbJdx+eDFk81sg4nMYjjto3o/
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral7/memory/1172-6-0x0000000007A00000-0x0000000007F74000-memory.dmp family_umbral -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1172 Yeezus.exe 1172 Yeezus.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe 1172 Yeezus.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1172 Yeezus.exe