c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe
Size

61KB
MD5

4c30ca6d71d72e8f0a0de13941b436e0
SHA1

9568297a3ddf4fb41ff80a5ba44135a507001f68
SHA256

c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6
SHA512

745d6f659ffa2e57153c3a9f491d2ec5204cf2b24f4fc5aafd68fb7bc6a3a59f549609e726d292a77a3ece7731c3fd04a83b70e98a45a982a5e19aac2154a1b6
SSDEEP

768:MDcpEBMLfQcubV5wGE96YyXDTLdEBBBBX:MDcfLfIbtEbyXfZe

Score

9^/10

evasion

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
C:\Windows\Debug\iuyhost.exe	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2224 attrib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2500 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

iuyhost.exe

pid process

1956 iuyhost.exe

pid	process
2224	attrib.exe

pid	process
2500	cmd.exe

pid	process
1956	iuyhost.exe

Drops file in Windows directory 3 IoCs

Processes:

attrib.exec8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\iuyhost.exe	attrib.exe
File created	C:\Windows\Debug\iuyhost.exe	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe

description pid process

Token: SeIncBasePriorityPrivilege 1544 c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe

description	pid	process	target process
PID 1544 wrote to memory of 2224	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	attrib.exe
PID 1544 wrote to memory of 2224	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	attrib.exe
PID 1544 wrote to memory of 2224	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	attrib.exe
PID 1544 wrote to memory of 2224	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	attrib.exe
PID 1544 wrote to memory of 2500	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	cmd.exe
PID 1544 wrote to memory of 2500	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	cmd.exe
PID 1544 wrote to memory of 2500	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	cmd.exe
PID 1544 wrote to memory of 2500	1544	c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2224 attrib.exe

pid	process
2224	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe
"C:\Users\Admin\AppData\Local\Temp\c8c3c733ecf4b4be6ff8454c6745403e7e4a66ddddcc6e26ab946bc1f1674aa6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\iuyhost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:2224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C8C3C7~1.EXE > nul
2⤵
- Deletes itself
PID:2500

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\iuyhost.exe
Filesize
62KB

MD5
4fe9378a2e6c92ed051f844cee398334

SHA1
e90828b179718e1737ed97784cf29a9511bc7764

SHA256
5fd2d6d67367add8e7060951291c8837c91be663bfef7268d4c8f02c5037e3ae

SHA512
b76b16bfdc67b8d9d024323b565a5f7816fba87c8732aa9390e96797d229c9cf9f79284b98d6d30ea5f9a0978b4e0bd3832a18757d772775f250fc01de4f1a24

Download Submit