Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-02-2024 06:14
Static task
static1
Behavioral task
behavioral1
Sample
86256b0347d1f99d7dedb71d7a7b05cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
86256b0347d1f99d7dedb71d7a7b05cd.exe
Resource
win10v2004-20231215-en
General
-
Target
86256b0347d1f99d7dedb71d7a7b05cd.exe
-
Size
141KB
-
MD5
86256b0347d1f99d7dedb71d7a7b05cd
-
SHA1
4fffc3f48bf33bbad7f4b74716b9398202fb3313
-
SHA256
597acac76ad725054269f8661e8d41c0066a73ed86076a8e76891a9f702edfca
-
SHA512
686bbbec01af6eb6f69e190856fd50711da4194a9811a125f672a28b56b8dd20e6a4af3b5af7291909b64c0bdc0961fe09abc6cc4ca3169ec284a472ca4c4f72
-
SSDEEP
1536:lEMVgMhxse5RNrQtLCADmHyDDTjmlA7BITcyLxrsmwZK9gyJGtjRLQHpJP15jBYq:cIPemHyDDTKetITpZy2GQHZYT4as
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2704 netsh.exe -
Drops startup file 4 IoCs
Processes:
86256b0347d1f99d7dedb71d7a7b05cd.exeywtbon.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkjtc.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkjtc.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkjtc.exe ywtbon.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkjtc.exe ywtbon.exe -
Executes dropped EXE 2 IoCs
Processes:
ywtbon.exeywtbon.exepid process 2160 ywtbon.exe 1704 ywtbon.exe -
Loads dropped DLL 2 IoCs
Processes:
86256b0347d1f99d7dedb71d7a7b05cd.exeywtbon.exepid process 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe 2160 ywtbon.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
86256b0347d1f99d7dedb71d7a7b05cd.exeywtbon.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\aihkgfge = "C:\\Users\\Admin\\AppData\\Local\\ywtbon.exe" 86256b0347d1f99d7dedb71d7a7b05cd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aihkgfge = "C:\\Users\\Admin\\AppData\\Local\\ywtbon.exe" ywtbon.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\aihkgfge = "C:\\Users\\Admin\\AppData\\Local\\ywtbon.exe" ywtbon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aihkgfge = "C:\\Users\\Admin\\AppData\\Local\\ywtbon.exe" 86256b0347d1f99d7dedb71d7a7b05cd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
86256b0347d1f99d7dedb71d7a7b05cd.exeywtbon.exedescription pid process target process PID 1436 set thread context of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 2160 set thread context of 1704 2160 ywtbon.exe ywtbon.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
86256b0347d1f99d7dedb71d7a7b05cd.exe86256b0347d1f99d7dedb71d7a7b05cd.exeywtbon.exedescription pid process target process PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 1436 wrote to memory of 2772 1436 86256b0347d1f99d7dedb71d7a7b05cd.exe 86256b0347d1f99d7dedb71d7a7b05cd.exe PID 2772 wrote to memory of 2704 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe netsh.exe PID 2772 wrote to memory of 2704 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe netsh.exe PID 2772 wrote to memory of 2704 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe netsh.exe PID 2772 wrote to memory of 2704 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe netsh.exe PID 2772 wrote to memory of 2160 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe ywtbon.exe PID 2772 wrote to memory of 2160 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe ywtbon.exe PID 2772 wrote to memory of 2160 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe ywtbon.exe PID 2772 wrote to memory of 2160 2772 86256b0347d1f99d7dedb71d7a7b05cd.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe PID 2160 wrote to memory of 1704 2160 ywtbon.exe ywtbon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86256b0347d1f99d7dedb71d7a7b05cd.exe"C:\Users\Admin\AppData\Local\Temp\86256b0347d1f99d7dedb71d7a7b05cd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\86256b0347d1f99d7dedb71d7a7b05cd.exeC:\Users\Admin\AppData\Local\Temp\86256b0347d1f99d7dedb71d7a7b05cd.exe2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram 1.exe 1 ENABLE3⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\ywtbon.exe"C:\Users\Admin\AppData\Local\ywtbon.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ywtbon.exeC:\Users\Admin\AppData\Local\ywtbon.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ywtbon.exeFilesize
141KB
MD586256b0347d1f99d7dedb71d7a7b05cd
SHA14fffc3f48bf33bbad7f4b74716b9398202fb3313
SHA256597acac76ad725054269f8661e8d41c0066a73ed86076a8e76891a9f702edfca
SHA512686bbbec01af6eb6f69e190856fd50711da4194a9811a125f672a28b56b8dd20e6a4af3b5af7291909b64c0bdc0961fe09abc6cc4ca3169ec284a472ca4c4f72
-
C:\Users\Admin\AppData\Local\ywtbon.exeFilesize
139KB
MD5488ffb43ae1a276c7868842a3835be37
SHA157cfc73a6a07b683b18191bf35867477d9c2a322
SHA256c75cfbe97ed137c92dc4dd6fc2645b26bd83953d1410c7f04f4412e488ad9f35
SHA512d4f3049b037fcb30e7a1681b1f0722ce3f310fd022fa65f0fb6bd0839db99694fba900246f4fbe90b46b3667a320b99cd767cd1a97ae36ead0c2a1b8e253f9e9
-
memory/1436-8-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/1436-13-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/1436-15-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/1436-11-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/1436-75-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/1704-82-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-85-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-90-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-89-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-88-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-87-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-86-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-78-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-84-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-83-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-81-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-73-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-74-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-80-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-76-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1704-79-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2160-55-0x0000000000280000-0x0000000000380000-memory.dmpFilesize
1024KB
-
memory/2160-77-0x0000000000280000-0x0000000000380000-memory.dmpFilesize
1024KB
-
memory/2160-53-0x0000000000280000-0x0000000000380000-memory.dmpFilesize
1024KB
-
memory/2160-51-0x0000000000280000-0x0000000000380000-memory.dmpFilesize
1024KB
-
memory/2160-49-0x0000000000280000-0x0000000000380000-memory.dmpFilesize
1024KB
-
memory/2772-17-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2772-19-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2772-14-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2772-58-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2772-28-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2772-21-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2772-29-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2772-26-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB