Overview

overview

10

Static

static

10

yuki.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yuki.exe

  • Size

    8.3MB

  • Sample

    241105-xcwmmawdpb

  • MD5

    bcfaa6dfe6f0003945ecf8c88c71cbe3

  • SHA1

    73d4a0f0956ec9054a3d7c709bccc5de0e0cb4ad

  • SHA256

    4d6895b29fa61f90199064bf2417f0a756a72e809194be571755cce8cc43d519

  • SHA512

    f4c170ae635dacf13ae20ee518400c422686588c3a8a44febb67da1921a6212ce6688e223ef686a4c07b0b758333a2c691ee9ed0733a9fd88e887dd9a5003311

  • SSDEEP

    196608:ykWhOdurErvI9pWjg/Qc+4o673pNrabebSEdyzWtPMYnNcsh:YuurEUWjZZ4dDLIeW7zWtPTNzh

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      yuki.exe

    • Size

      8.3MB

    • MD5

      bcfaa6dfe6f0003945ecf8c88c71cbe3

    • SHA1

      73d4a0f0956ec9054a3d7c709bccc5de0e0cb4ad

    • SHA256

      4d6895b29fa61f90199064bf2417f0a756a72e809194be571755cce8cc43d519

    • SHA512

      f4c170ae635dacf13ae20ee518400c422686588c3a8a44febb67da1921a6212ce6688e223ef686a4c07b0b758333a2c691ee9ed0733a9fd88e887dd9a5003311

    • SSDEEP

      196608:ykWhOdurErvI9pWjg/Qc+4o673pNrabebSEdyzWtPMYnNcsh:YuurEUWjZZ4dDLIeW7zWtPTNzh

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks