Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 19:42
Behavioral task
behavioral1
Sample
129de086d65beaa64f4789c6f467fcd2.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
129de086d65beaa64f4789c6f467fcd2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
129de086d65beaa64f4789c6f467fcd2.exe
-
Size
65KB
-
MD5
129de086d65beaa64f4789c6f467fcd2
-
SHA1
c4f4b9c9a701dc64522ab7031aaa04bcb4e5f54e
-
SHA256
00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd
-
SHA512
7981172ebdf0083ca6ae34734c1993fc1aef667909e1daa08f4c9a236831da83cd73c4f4a9c7745870b430d6200620662797f1f7eba232b4574a06b81553d04b
-
SSDEEP
1536:tWOeboN36tbQviFw1ScTIBnvbBfLteF3nLrB9z3nWaF9bZS9vM:tWOeboN36tbQviFCtcBnVfWl9zGaF9bN
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 129de086d65beaa64f4789c6f467fcd2.exe -
Executes dropped EXE 1 IoCs
pid Process 4584 yzbekt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .." yzbekt.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .." yzbekt.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 42 0.tcp.eu.ngrok.io 77 0.tcp.eu.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 129de086d65beaa64f4789c6f467fcd2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yzbekt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Kills process with taskkill 4 IoCs
pid Process 3760 TASKKILL.exe 4588 TASKKILL.exe 216 TASKKILL.exe 380 TASKKILL.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 3304 129de086d65beaa64f4789c6f467fcd2.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe 4584 yzbekt.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 3304 129de086d65beaa64f4789c6f467fcd2.exe Token: SeDebugPrivilege 3760 TASKKILL.exe Token: SeDebugPrivilege 4588 TASKKILL.exe Token: SeDebugPrivilege 4584 yzbekt.exe Token: SeDebugPrivilege 380 TASKKILL.exe Token: SeDebugPrivilege 216 TASKKILL.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe Token: 33 4584 yzbekt.exe Token: SeIncBasePriorityPrivilege 4584 yzbekt.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3304 wrote to memory of 3760 3304 129de086d65beaa64f4789c6f467fcd2.exe 84 PID 3304 wrote to memory of 3760 3304 129de086d65beaa64f4789c6f467fcd2.exe 84 PID 3304 wrote to memory of 3760 3304 129de086d65beaa64f4789c6f467fcd2.exe 84 PID 3304 wrote to memory of 4588 3304 129de086d65beaa64f4789c6f467fcd2.exe 85 PID 3304 wrote to memory of 4588 3304 129de086d65beaa64f4789c6f467fcd2.exe 85 PID 3304 wrote to memory of 4588 3304 129de086d65beaa64f4789c6f467fcd2.exe 85 PID 3304 wrote to memory of 4584 3304 129de086d65beaa64f4789c6f467fcd2.exe 102 PID 3304 wrote to memory of 4584 3304 129de086d65beaa64f4789c6f467fcd2.exe 102 PID 3304 wrote to memory of 4584 3304 129de086d65beaa64f4789c6f467fcd2.exe 102 PID 3304 wrote to memory of 4772 3304 129de086d65beaa64f4789c6f467fcd2.exe 103 PID 3304 wrote to memory of 4772 3304 129de086d65beaa64f4789c6f467fcd2.exe 103 PID 3304 wrote to memory of 4772 3304 129de086d65beaa64f4789c6f467fcd2.exe 103 PID 4584 wrote to memory of 380 4584 yzbekt.exe 105 PID 4584 wrote to memory of 380 4584 yzbekt.exe 105 PID 4584 wrote to memory of 380 4584 yzbekt.exe 105 PID 4584 wrote to memory of 216 4584 yzbekt.exe 106 PID 4584 wrote to memory of 216 4584 yzbekt.exe 106 PID 4584 wrote to memory of 216 4584 yzbekt.exe 106 PID 4772 wrote to memory of 2912 4772 cmd.exe 109 PID 4772 wrote to memory of 2912 4772 cmd.exe 109 PID 4772 wrote to memory of 2912 4772 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\129de086d65beaa64f4789c6f467fcd2.exe"C:\Users\Admin\AppData\Local\Temp\129de086d65beaa64f4789c6f467fcd2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Users\Admin\AppData\Roaming\yzbekt.exe"C:\Users\Admin\AppData\Roaming\yzbekt.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\129de086d65beaa64f4789c6f467fcd2.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:2912
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5129de086d65beaa64f4789c6f467fcd2
SHA1c4f4b9c9a701dc64522ab7031aaa04bcb4e5f54e
SHA25600d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd
SHA5127981172ebdf0083ca6ae34734c1993fc1aef667909e1daa08f4c9a236831da83cd73c4f4a9c7745870b430d6200620662797f1f7eba232b4574a06b81553d04b