-y�҆�����(Be+O�� ��n��v�����ּs��:|iI�.���aV�\��[ #8CX�Iǧ�� �#f��S�[��9O���_MS] ���6��n!�8�pM��J��χ��FSش:yF����k��/��-#��D��*+�~��hjU����<���������k��6�������U�&�K�}ʌ$xА�n����ٷ�d5 �m���h(`�?������i�)5C����肸}n�.m����÷j{��/�̑��v����%���a�BU�y.D�@Ǻ a��B\%���Ɏ��5咃�֨�9h�p���D?ۋ���.ˌ�� �,�̠��1�UD�e�x���(�d3!�ŭq�()��D)���'�\u*�j��.I+&g���~����G�����:a?�Nn�l����o�?qi��O��@GB��!aM9��JZޙ�j]�yц���}�&hv�K�Al67��(�hi��P���X�����>Ꚕ�U?�G�pS��g�syD�^z�;���t�t�ٖ������'��b"����;�Қ�2I��O\�?�(��/�1�0����EN:c[��XQ�^�N�p�s��7%DP�B��K����nR�P�k�f<��d'��[�t�u�[iV-}����N�*l-%UY729�7mx]��B�<�`�9���^�W@��b��IxA�Rn�Dv�}u=.��Qe�,�>�b;��kK�ܑ1c�+�i�W�l ^ø���I�|�_{T6A�o�|Ԡ��>M�<�L��c���)�m4<� ��i��P*7�kq�)��F�>J�x��-� 8%��x� �v�14��<������X��۶��@��fj0�w8�K�V^� ���+e4/��$_eo1D�~_ �g�ysr�|�ɩ�b�ZI��Jd�z�g؞��)��I����#��j�c���:��T��� 2É�]���'�Ѻؗa��h��'����J��)5�lc�iUAmY�uAߩ��`L<������) �܊D5�ƺz�E��|u�/݊�ؼL�����gAV��Ook`�1h�I���B|������^�̦�w�킎֛��#X��>�U�\����(�@r��l���(��)I0��$w�!-������N��Z�}��O"��g���apfɾ����d��l����<p�-b�QK��^Mc�i�g8i�<�y��{P�|$UU?qD>1اB�@��rE*(�y��n0�〽�}N�a(�Z*�(�G7�1�c�f/�hH)�LU֟���j���X5T��[�Bzh��>��*�mH�c�����18u9r����}T�b.����;di2���$��[���=�K���o[I�����?g�5xR�'����y��ƿ����4{sy�!�p��e�>�1��X�5�h��x��b�r,��x�^Ӯ�����@�F�,��9?H�K�o�J�� �����K<�~�F�<v��.�����,�^ZqJ��:��2�#��oz:��=q֠�6�&ѯ*�"�095�,�����ɨg����Z��Eǀo�UΈ^A�Q��8�4P�F�͝����y?(�n ��n��{}�z����h�2c>˄�s��|�}����ޙ�y�7��]E� pld��`�k��Xa���Rg4RbP��mᶣcf���� ��E~�����/��v��->!�f�B��_9�R�J�n}��'h��$�"0�@/�{FPi_M��S����]y�L�ի��̀���?f|a(�� ����4)Ft�{i�i�ĩ��^� ̆�˙��x:W��i N;z�5B_� ��sq3 �TI�G�}V���c���4}~#1�����B%j���Y��=ډ���H��!���5�8-�~��i�/� ��[O�B��f��ޔp��)��.mϓYb���d$DH���9B�s������.T~8�)��}_��Z��Ϗt�+�4��mM�x�@ �K�"��8�S��x��٥����u�'@_�%�Ɣ����D�e<v!��"!ϲ}V�]'\>��:��ف�61�� �h�-!��@��8$�6E���+P�Y�������h�_\��c���|��~aH��U��<��XZ�<�i�o�ky�1��k�֫���2[8�@,0e�qD�8�l�-=�^�a�1�0i��)�� ��XF���6.�d�v����d�$���ڇ�mX��η� �j�Ħ�p�x��ٚ�:T[���A�;n`�\t���{�W�[7鱗3u�����0lZ�h^�zc.�� ��Clʜ$�FLM�Gq`�w��8R���WN���CR�x��H�Fn��0�O+�[�<�S�|KQ� Z �o[��9v��3��z9���b��.P������6i���X/��?ͣ�04����+S�r�E�Y�k�A�)8� I��"��\�I�Hz�euOpQ�W��>k�j�8��^�f`<`��횥zg�w����E��C���%;[���|����U;仈�Yr�AC'W���N�q3mEk�8�������q��RL�C��\��Sj?��7eK�Qj �����M�B'q��D��������Y���H���dď��t�8�5 ��������9�-� ��.�C#rY'�Mv�ի`�@@z�>�i\��n����9�4�!w �p�f��HIo�߃N�fnXqAn![��_����w�����o!��"z�d�_��AxQ��XD�w���C#�M���_���t�m ��/���/-z��� ��5j�h|�ș�*������r�UՎ(�#�\~�ҹ�O�M(h�tҁ2L B�R�̲��ch[P��kh�ͥ���+��������!��TP=��]+��F��my�4L�yL=�31�$��W�����]f����+�%��\��.*^�m�,��.^�l+���zl7M��xWS1�����6LA��D �Xh��o8��W����T��E�[(��/'u���$G�U�����x�����O��N�w���xU%46t/�� �k$���Z!P��BYq��ɑ��x����]�Č��Ԡ��a!���PY�rDnͯ3還�x�[����)v����R�>ryҽN{��b�}
Static task
static1
Behavioral task
behavioral1
Sample
yenosist_loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
yenosist_loader.exe
Resource
win10v2004-20240426-en
General
-
Target
yenosist_loader.exe
-
Size
13.1MB
-
MD5
7a3b99e13c5524b41314c5a427447db5
-
SHA1
257f0d999f7548606828d3640638a073a9162054
-
SHA256
a2f59aa4bcd8240b1cdfe2327c9e94050835e210745948006bf4f5af1a4fb4b7
-
SHA512
fb8575f309761a94500ada78465c55f367b8736127ab7079834590202a12448e1cfcc316be937feae8691a73ca301737f3be077cd270db1f2dfa564ef37d35dd
-
SSDEEP
393216:O7bDRYY9qBOxAz/8QXuzJddWhwyZ404Tou5hX:OtMB//n+zp2NZ4eu3X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource yenosist_loader.exe
Files
-
yenosist_loader.exe.exe windows:6 windows x64 arch:x64
ea665bce3f1ab7d4d6cfa9ff8cd8b857
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetCurrentProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsWindowUnicode
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
shell32
ShellExecuteA
msvcp140
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord79
crypt32
CryptQueryObject
ws2_32
htons
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-time-l1-1-0
_gmtime64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
clonaz.a Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
clonaz.g Size: - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
clonaz.a Size: - Virtual size: 342KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
clonaz.e Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
clonaz.k Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
clonaz.b Size: 13.1MB - Virtual size: 13.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
clonaz.l Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ