739705ee99c920e042e31b69f302955e75b6e9c11811366f0caef0aff407797d

General

Target

b9bc959031d3f0c147c914bc9080318a.exe
Size

62KB
MD5

b9bc959031d3f0c147c914bc9080318a
SHA1

2e70d59ed58541af5efe11ffa48c511e3f182cf2
SHA256

739705ee99c920e042e31b69f302955e75b6e9c11811366f0caef0aff407797d
SHA512

7032a43b6434e5d2db4c58f991f997560b41679f9c028a9dc01ba5facd799d8aeb6a94ee0ebddf5931486f43cc5979af02c54deeaeaee19ff3ce07949038a453
SSDEEP

1536:0YbzLgR1hGlrE4smqSApftLLpcOEmEA6cYDX8B1osAeyc9X:0PREJsVSm/bExy19Aev

Score

7^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000012262-10.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1908	b9bc959031d3f0c147c914bc9080318a.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012262-10.dat	upx
behavioral1/memory/1908-11-0x0000000010000000-0x0000000010051000-memory.dmp	upx
behavioral1/memory/1908-18-0x0000000010000000-0x0000000010051000-memory.dmp	upx

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvbb01\Startup = "XFD001arex"	b9bc959031d3f0c147c914bc9080318a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvbb01\Impersonate = "1"	b9bc959031d3f0c147c914bc9080318a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvbb01\Asynchronous = "1"	b9bc959031d3f0c147c914bc9080318a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvbb01\MaxWait = "1"	b9bc959031d3f0c147c914bc9080318a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvbb01	b9bc959031d3f0c147c914bc9080318a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	b9bc959031d3f0c147c914bc9080318a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvbb01\CID = "[7190706964766362726]"	b9bc959031d3f0c147c914bc9080318a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yvbb01\DllName = "yvbb01.dll"	b9bc959031d3f0c147c914bc9080318a.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qo.dll	b9bc959031d3f0c147c914bc9080318a.exe
File opened for modification	C:\Windows\SysWOW64\qo.dll	b9bc959031d3f0c147c914bc9080318a.exe
File created	C:\Windows\SysWOW64\yvbb02.sys	b9bc959031d3f0c147c914bc9080318a.exe
File created	C:\Windows\SysWOW64\qo.sys	b9bc959031d3f0c147c914bc9080318a.exe
File created	C:\Windows\SysWOW64\yvbb01.sys	b9bc959031d3f0c147c914bc9080318a.exe
File opened for modification	C:\Windows\SysWOW64\kgctini.dat	b9bc959031d3f0c147c914bc9080318a.exe
File opened for modification	C:\Windows\SysWOW64\lps.dat	b9bc959031d3f0c147c914bc9080318a.exe
File created	C:\Windows\SysWOW64\yvbb01.dll	b9bc959031d3f0c147c914bc9080318a.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1908	b9bc959031d3f0c147c914bc9080318a.exe
1908	b9bc959031d3f0c147c914bc9080318a.exe
1908	b9bc959031d3f0c147c914bc9080318a.exe
1908	b9bc959031d3f0c147c914bc9080318a.exe
1908	b9bc959031d3f0c147c914bc9080318a.exe
1908	b9bc959031d3f0c147c914bc9080318a.exe
1908	b9bc959031d3f0c147c914bc9080318a.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	b9bc959031d3f0c147c914bc9080318a.exe
Token: SeShutdownPrivilege	1908	b9bc959031d3f0c147c914bc9080318a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1192	1908	b9bc959031d3f0c147c914bc9080318a.exe	21
PID 1908 wrote to memory of 1192	1908	b9bc959031d3f0c147c914bc9080318a.exe	21
PID 1908 wrote to memory of 1192	1908	b9bc959031d3f0c147c914bc9080318a.exe	21
PID 1908 wrote to memory of 1192	1908	b9bc959031d3f0c147c914bc9080318a.exe	21
PID 1908 wrote to memory of 1192	1908	b9bc959031d3f0c147c914bc9080318a.exe	21
PID 1908 wrote to memory of 1192	1908	b9bc959031d3f0c147c914bc9080318a.exe	21
PID 1908 wrote to memory of 1192	1908	b9bc959031d3f0c147c914bc9080318a.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\b9bc959031d3f0c147c914bc9080318a.exe
  "C:\Users\Admin\AppData\Local\Temp\b9bc959031d3f0c147c914bc9080318a.exe"
  2⤵
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\yvbb01.dll

Filesize
48KB

MD5
3713440e3f39870d040a7d2f343796df

SHA1
6f513c6c7a8d2e74415bb82bcbc5a3c9757442a6

SHA256
8f0f9f3dedd8fb165560ec978b6587311171b3535675aa51f2cd3b96f29fb9c3

SHA512
3367c00c5faa6808e0644b96969f2485957d12b21076ec80665e2656a08b9478d3857b98f98b2566e6673baced569a7a6bd95f2aa17e6df1632a94049c5df6b1

Download Submit
C:\Windows\SysWOW64\yvbb01.sys

Filesize
20KB

MD5
97f71c71fb9aac6bd37e55a77e47dbfb

SHA1
9bbba5fb0f675b024ecf15a1c607c2f64e1a6352

SHA256
4d96fb3ce176b3a4fd0b57fb02e587da2829bd30e76936396b93f68bc7bb60b7

SHA512
057066ba68d5ee6989c0620972eb21b0194aa804163954385e17fbf8e4d9bef6e2817404c26fde188449bbd6f0c2b370cb0f6067122a6e588f4400bfc0ab90fb

Download Submit
memory/1192-14-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1908-11-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1908-17-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1908-18-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads