Overview

overview

7

Static

static

3

yx_dts.exe

windows7-x64

7

yx_dts.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

dts.exe

windows7-x64

3

dts.exe

windows10-2004-x64

3

iconAnimate.exe

windows7-x64

3

iconAnimate.exe

windows10-2004-x64

3

iconTips.exe

windows7-x64

3

iconTips.exe

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yx_dts.exe

  • Size

    889KB

  • Sample

    241119-ra4bss1qcr

  • MD5

    09ce8089df9c73890dd0569c053e10c5

  • SHA1

    ca150d526dc7bf9161b8b9da4617ff461d5ae9d9

  • SHA256

    d6ac9b5838aad1062ed759ee201e77e07314a0434a9236c6f8b54363e79c541b

  • SHA512

    414c80288666d609740956aec1f999d07412ee1998574da2374847a46137d828d4b42917c50ab167272313e802da03099bdb6d3518812fa307640c960cf8df6c

  • SSDEEP

    24576:4617vD7Kv8d4lXdcGs3KAh++8JS7+Jrmzo8t:4G7L+TY73l58JS7CKoy

Score
7/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      yx_dts.exe

    • Size

      889KB

    • MD5

      09ce8089df9c73890dd0569c053e10c5

    • SHA1

      ca150d526dc7bf9161b8b9da4617ff461d5ae9d9

    • SHA256

      d6ac9b5838aad1062ed759ee201e77e07314a0434a9236c6f8b54363e79c541b

    • SHA512

      414c80288666d609740956aec1f999d07412ee1998574da2374847a46137d828d4b42917c50ab167272313e802da03099bdb6d3518812fa307640c960cf8df6c

    • SSDEEP

      24576:4617vD7Kv8d4lXdcGs3KAh++8JS7+Jrmzo8t:4G7L+TY73l58JS7CKoy

    Score
    7/10
    bootkitdiscoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      dts.exe

    • Size

      843KB

    • MD5

      d0e6bfcf97bc61745ba68118df26b971

    • SHA1

      cc3696f5722ee55acddadd8ca5495294d47ae455

    • SHA256

      23b94fb2952b692f6e8e7dbd2bb4ae013cb4ad2c0b99066a2538d5c73b4a4216

    • SHA512

      0c9106d4c9414e54c7c19d8a11b441fd1bfb013e02d5990c7acc5c5c3b73b1a3efd8effd5a98fa5c54033a80b33605f5324084ccb497130ffb366dd44ac80e09

    • SSDEEP

      12288:RfpUaTZvdsuD1FGKL3ThvmdaM7PpjjibWBqxzrNQM+UXraBTZrRVPUwU6f8CLNd8:fTNKmGk3dKhG6AxzlDOBFXlLNd4z90an

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      iconAnimate.exe

    • Size

      302KB

    • MD5

      23e3dff51a4954999db5cb8960e62dee

    • SHA1

      75049f8272e152e040b00d8ee95d8d3171229ed2

    • SHA256

      986c5276ea987552477177acd191214b30fc75266fbb96a16ae0c11830a9e9be

    • SHA512

      7eb7fa702374c501e733011e7cd3dd952a1f7bf458de6f71568078e6b701e7e46b8a4550c7f9a8b95c43907a2ce0274efc2072442f035bc4b1fcab6da67026e8

    • SSDEEP

      6144:La7SY+GpLJYQyce8TlERukmKiuwv11rf1Ar3Q1Wa:La7agFYQygKiuwNV1ACWa

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      iconTips.exe

    • Size

      239KB

    • MD5

      a40dea01c7258a9b3129cb2d8d5186fe

    • SHA1

      bbe5cb435d5249480cc66bc3f253c192b7ba3f7d

    • SHA256

      84cc59a0bddbf244e1b37607c0bd522c9938f903b73a81db09e1c884abb53f6c

    • SHA512

      53f0eac2d1b5df4044dc523e05326fe906ae3351fe17aa73ae8473418a2ec0fa09b917160eeeb3345ea0e5b4bfd08365aa1dc9111d591fabb8203d17b05763eb

    • SSDEEP

      1536:SzMlsJVj/J7RJt5TRcBjZQlsrOb4OYqTGVICm8BQdkXHy:JiZdR5Ts9O8OYm2IX8qk3y

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      uninst.exe

    • Size

      290KB

    • MD5

      a9b0e998f68a00c1e1645d175f8a3da6

    • SHA1

      6aa996654eec8702f1a5d7d44ed3f0b7968744ec

    • SHA256

      76cf899ca260b581326297a3130a66f01db9eab3e3216eaa6341047aaf16df97

    • SHA512

      43d174efb410c6b5bdd9055e93af42a11f22e658111d69d234fa860b7710de7dce6392125cc51e4c86037a4487c2e4297d7c673bbd9f2b52269bc84c86d8c48e

    • SSDEEP

      6144:ze34W4lHyCn4ik6yiUfFY2SzpYn2/gnqqjGb:UuFkJy2Sz6n2/h

    Score
    7/10
    bootkitdiscoverypersistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      c498ae64b4971132bba676873978de1e

    • SHA1

      92e4009cd776b6c8616d8bffade7668ef3cb3c27

    • SHA256

      5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

    • SHA512

      8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

    • SSDEEP

      384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      c10e04dd4ad4277d5adc951bb331c777

    • SHA1

      b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    • SHA256

      e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    • SHA512

      853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    • SSDEEP

      96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420

    Score
    3/10
    discovery
    behavioral27behavioral28

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoverypersistence
Score
7/10

behavioral2

bootkitdiscoverypersistence
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

bootkitdiscoverypersistence
Score
7/10

behavioral18

bootkitdiscoverypersistence
Score
7/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10