21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979

General

Target

21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe
Size

155KB
MD5

5ca39da3b8dd7b5421e04b2c481218ba
SHA1

6b75242c45ac375b0df3d94d0a1f1ef705ef3203
SHA256

21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979
SHA512

2d7cbd1bde00b816fa5764eeb2d2a3c75aa1f1c238e3e9bace7913cf3d1bde5fda807410bdc6c7ad57b9ced4293e34d2cbaa605996aa054f00b78ac06329e4d2
SSDEEP

3072:oZpYg19EeiLLmjempGuCYooEK1JWaCItULG3rt2Wcora4dI9:OPjEl6jLiQ1JW+Oy3p/e

Score

7^/10

bootkit persistence spyware stealer

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\??\c:\Program Files\pzhtt\ciskg.dll	acprotect

Deletes itself 1 IoCs

Processes:

yavlm.exe

pid process

1608 yavlm.exe
Executes dropped EXE 2 IoCs

Processes:

yavlm.execis.exe

pid process

1608 yavlm.exe
396 cis.exe
Loads dropped DLL 1 IoCs

Processes:

cis.exe

pid process

396 cis.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1608	yavlm.exe

pid	process
1608	yavlm.exe
396	cis.exe

pid	process
396	cis.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cis.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Linycpy = "c:\\Program Files\\pzhtt\\cis.exe \"c:\\Program Files\\pzhtt\\ciskg.dll\",SetHandle"	cis.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cis.exe

description	ioc	process
File opened (read-only)	\??\m:	cis.exe
File opened (read-only)	\??\u:	cis.exe
File opened (read-only)	\??\a:	cis.exe
File opened (read-only)	\??\e:	cis.exe
File opened (read-only)	\??\g:	cis.exe
File opened (read-only)	\??\i:	cis.exe
File opened (read-only)	\??\k:	cis.exe
File opened (read-only)	\??\l:	cis.exe
File opened (read-only)	\??\v:	cis.exe
File opened (read-only)	\??\z:	cis.exe
File opened (read-only)	\??\w:	cis.exe
File opened (read-only)	\??\b:	cis.exe
File opened (read-only)	\??\h:	cis.exe
File opened (read-only)	\??\p:	cis.exe
File opened (read-only)	\??\s:	cis.exe
File opened (read-only)	\??\x:	cis.exe
File opened (read-only)	\??\y:	cis.exe
File opened (read-only)	\??\j:	cis.exe
File opened (read-only)	\??\n:	cis.exe
File opened (read-only)	\??\o:	cis.exe
File opened (read-only)	\??\q:	cis.exe
File opened (read-only)	\??\r:	cis.exe
File opened (read-only)	\??\t:	cis.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

cis.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 cis.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	cis.exe

Drops file in Program Files directory 4 IoCs

Processes:

yavlm.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\pzhtt\cis.exe	yavlm.exe
File opened for modification	\??\c:\Program Files\pzhtt	yavlm.exe
File created	\??\c:\Program Files\pzhtt\ciskg.dll	yavlm.exe
File created	\??\c:\Program Files\pzhtt\cis.exe	yavlm.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cis.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cis.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cis.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1392 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

cis.exe

pid process

396 cis.exe
396 cis.exe
396 cis.exe
396 cis.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cis.exe

description pid process

Token: SeDebugPrivilege 396 cis.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exeyavlm.exe

pid process

3708 21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe
1608 yavlm.exe

pid	process
1392	PING.EXE

pid	process
396	cis.exe
396	cis.exe
396	cis.exe
396	cis.exe

description	pid	process
Token: SeDebugPrivilege	396	cis.exe

pid	process
3708	21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe
1608	yavlm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.execmd.exeyavlm.exe

description	pid	process	target process
PID 3708 wrote to memory of 2980	3708	21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe	cmd.exe
PID 3708 wrote to memory of 2980	3708	21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe	cmd.exe
PID 3708 wrote to memory of 2980	3708	21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe	cmd.exe
PID 2980 wrote to memory of 1392	2980	cmd.exe	PING.EXE
PID 2980 wrote to memory of 1392	2980	cmd.exe	PING.EXE
PID 2980 wrote to memory of 1392	2980	cmd.exe	PING.EXE
PID 2980 wrote to memory of 1608	2980	cmd.exe	yavlm.exe
PID 2980 wrote to memory of 1608	2980	cmd.exe	yavlm.exe
PID 2980 wrote to memory of 1608	2980	cmd.exe	yavlm.exe
PID 1608 wrote to memory of 396	1608	yavlm.exe	cis.exe
PID 1608 wrote to memory of 396	1608	yavlm.exe	cis.exe
PID 1608 wrote to memory of 396	1608	yavlm.exe	cis.exe

C:\Users\Admin\AppData\Local\Temp\21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe
"C:\Users\Admin\AppData\Local\Temp\21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\yavlm.exe "C:\Users\Admin\AppData\Local\Temp\21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1392
- - C:\Users\Admin\AppData\Local\Temp\yavlm.exe
    C:\Users\Admin\AppData\Local\Temp\\yavlm.exe "C:\Users\Admin\AppData\Local\Temp\21a5eb2b35e40da1e596c9e33c7f4ea8f2040b98abfe5d874667b2900867c979.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - \??\c:\Program Files\pzhtt\cis.exe
      "c:\Program Files\pzhtt\cis.exe" "c:\Program Files\pzhtt\ciskg.dll",SetHandle C:\Users\Admin\AppData\Local\Temp\yavlm.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Enumerates connected drives
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\pzhtt\cis.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
C:\Users\Admin\AppData\Local\Temp\yavlm.exe

Filesize
155KB

MD5
1b1ec61e42eced4fcf917f31aa1824b5

SHA1
f07a72f5fb82d3bbcde10c473135e858a1fab4f4

SHA256
890e47cdec5568ebc531a3ddc27d64c34d50a8491a1c0b05bb624aa0b3bf7f93

SHA512
ab9d2ba5c022b876b67fb99332401b1916625c6c6dce296eda3b378df876d5c2c2082136bd12d06c6787f658aa43746a49c10c051ea7a2c53e2dce3734c675cd

Download Submit
\??\c:\Program Files\pzhtt\ciskg.dll

Filesize
128KB

MD5
08072fe2dba4b36377f740b45b00321b

SHA1
ae03fa6945850b0db62202af6313b1ed10e9e512

SHA256
359390e360d67f80f1b42543bfd31ef8098cc353d444160f551ae82a442f9ffd

SHA512
cf3d0a0ac2de75300f1df5439a4506bc4c8f2c26915c5a38f0604aeac7a1d2bee1d7265ef0ae68648f3e09ca26badfde1b137ed2ddb2ffedc6c868e0f67b7e81

Download Submit
memory/396-15-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/396-16-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/396-18-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/396-20-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download
memory/1608-11-0x0000000000400000-0x000000000042F036-memory.dmp

Filesize
188KB

Download
memory/3708-0-0x0000000000400000-0x000000000042F036-memory.dmp

Filesize
188KB

Download
memory/3708-2-0x0000000000400000-0x000000000042F036-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads