Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 01:01
Behavioral task
behavioral1
Sample
00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe
-
Size
65KB
-
MD5
129de086d65beaa64f4789c6f467fcd2
-
SHA1
c4f4b9c9a701dc64522ab7031aaa04bcb4e5f54e
-
SHA256
00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd
-
SHA512
7981172ebdf0083ca6ae34734c1993fc1aef667909e1daa08f4c9a236831da83cd73c4f4a9c7745870b430d6200620662797f1f7eba232b4574a06b81553d04b
-
SSDEEP
1536:tWOeboN36tbQviFw1ScTIBnvbBfLteF3nLrB9z3nWaF9bZS9vM:tWOeboN36tbQviFCtcBnVfWl9zGaF9bN
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe -
Executes dropped EXE 1 IoCs
pid Process 916 yzbekt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .." yzbekt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .." yzbekt.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 42 0.tcp.eu.ngrok.io 81 0.tcp.eu.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yzbekt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe -
Kills process with taskkill 4 IoCs
pid Process 3972 TASKKILL.exe 3548 TASKKILL.exe 2028 TASKKILL.exe 4720 TASKKILL.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe 916 yzbekt.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe Token: SeDebugPrivilege 4720 TASKKILL.exe Token: SeDebugPrivilege 3972 TASKKILL.exe Token: SeDebugPrivilege 916 yzbekt.exe Token: SeDebugPrivilege 3548 TASKKILL.exe Token: SeDebugPrivilege 2028 TASKKILL.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe Token: 33 916 yzbekt.exe Token: SeIncBasePriorityPrivilege 916 yzbekt.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4720 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 86 PID 4092 wrote to memory of 4720 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 86 PID 4092 wrote to memory of 4720 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 86 PID 4092 wrote to memory of 3972 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 87 PID 4092 wrote to memory of 3972 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 87 PID 4092 wrote to memory of 3972 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 87 PID 4092 wrote to memory of 916 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 98 PID 4092 wrote to memory of 916 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 98 PID 4092 wrote to memory of 916 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 98 PID 4092 wrote to memory of 2636 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 99 PID 4092 wrote to memory of 2636 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 99 PID 4092 wrote to memory of 2636 4092 00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe 99 PID 916 wrote to memory of 2028 916 yzbekt.exe 101 PID 916 wrote to memory of 2028 916 yzbekt.exe 101 PID 916 wrote to memory of 2028 916 yzbekt.exe 101 PID 916 wrote to memory of 3548 916 yzbekt.exe 102 PID 916 wrote to memory of 3548 916 yzbekt.exe 102 PID 916 wrote to memory of 3548 916 yzbekt.exe 102 PID 2636 wrote to memory of 2864 2636 cmd.exe 105 PID 2636 wrote to memory of 2864 2636 cmd.exe 105 PID 2636 wrote to memory of 2864 2636 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe"C:\Users\Admin\AppData\Local\Temp\00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
C:\Users\Admin\AppData\Roaming\yzbekt.exe"C:\Users\Admin\AppData\Roaming\yzbekt.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\00d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:2864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5129de086d65beaa64f4789c6f467fcd2
SHA1c4f4b9c9a701dc64522ab7031aaa04bcb4e5f54e
SHA25600d1f7f784455f77516c396b46d234d64a2cfa8f70bab5f1a9f8bcd97aa502fd
SHA5127981172ebdf0083ca6ae34734c1993fc1aef667909e1daa08f4c9a236831da83cd73c4f4a9c7745870b430d6200620662797f1f7eba232b4574a06b81553d04b