Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2024 20:39
Behavioral task
behavioral1
Sample
1732-1-0x0000000000270000-0x0000000000286000-memory.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1732-1-0x0000000000270000-0x0000000000286000-memory.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1732-1-0x0000000000270000-0x0000000000286000-memory.exe
-
Size
88KB
-
MD5
57a6137708aa3c2866131919b12d17c2
-
SHA1
4328e6c04348966ba9cb2a5f3883ccb51571cda8
-
SHA256
d8b284c741d37196fbf6fe4513bf457f158a65b1b649a71f12855669e6bbcbeb
-
SHA512
80a4f19ef88327b8048ab075aeddc9cc8b1123db2fb1dbff5de4783c6a68b833e78c51ec0b87a0c6b626c7f8edf708e974693e088b84dc964891acac02cb493a
-
SSDEEP
1536:CXOeboN36tbQviFw1ScTIBnvAefLteF3nLrB9z3nTaF9btS9vM:CXOeboN36tbQviFCtcBn1fWl9zDaF9bJ
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1732-1-0x0000000000270000-0x0000000000286000-memory.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 1732-1-0x0000000000270000-0x0000000000286000-memory.exe -
Executes dropped EXE 1 IoCs
Processes:
yzbekt.exepid Process 2652 yzbekt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
yzbekt.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .." yzbekt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .." yzbekt.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 28 0.tcp.eu.ngrok.io 58 0.tcp.eu.ngrok.io 78 0.tcp.eu.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
choice.exe1732-1-0x0000000000270000-0x0000000000286000-memory.exeyzbekt.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1732-1-0x0000000000270000-0x0000000000286000-memory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yzbekt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
yzbekt.exepid Process 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe 2652 yzbekt.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
yzbekt.exedescription pid Process Token: SeDebugPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe Token: 33 2652 yzbekt.exe Token: SeIncBasePriorityPrivilege 2652 yzbekt.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1732-1-0x0000000000270000-0x0000000000286000-memory.execmd.exedescription pid Process procid_target PID 1112 wrote to memory of 2652 1112 1732-1-0x0000000000270000-0x0000000000286000-memory.exe 92 PID 1112 wrote to memory of 2652 1112 1732-1-0x0000000000270000-0x0000000000286000-memory.exe 92 PID 1112 wrote to memory of 2652 1112 1732-1-0x0000000000270000-0x0000000000286000-memory.exe 92 PID 1112 wrote to memory of 2284 1112 1732-1-0x0000000000270000-0x0000000000286000-memory.exe 93 PID 1112 wrote to memory of 2284 1112 1732-1-0x0000000000270000-0x0000000000286000-memory.exe 93 PID 1112 wrote to memory of 2284 1112 1732-1-0x0000000000270000-0x0000000000286000-memory.exe 93 PID 2284 wrote to memory of 4608 2284 cmd.exe 96 PID 2284 wrote to memory of 4608 2284 cmd.exe 96 PID 2284 wrote to memory of 4608 2284 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\1732-1-0x0000000000270000-0x0000000000286000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1732-1-0x0000000000270000-0x0000000000286000-memory.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Roaming\yzbekt.exe"C:\Users\Admin\AppData\Roaming\yzbekt.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\1732-1-0x0000000000270000-0x0000000000286000-memory.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:4608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD557a6137708aa3c2866131919b12d17c2
SHA14328e6c04348966ba9cb2a5f3883ccb51571cda8
SHA256d8b284c741d37196fbf6fe4513bf457f158a65b1b649a71f12855669e6bbcbeb
SHA51280a4f19ef88327b8048ab075aeddc9cc8b1123db2fb1dbff5de4783c6a68b833e78c51ec0b87a0c6b626c7f8edf708e974693e088b84dc964891acac02cb493a