601a5853fbe96c1d11fec29a95dc9efcef2f457a8915e183c789f71848786bfc

Resubmissions

19/11/2024, 15:13

241119-slznesybpk 3

19/11/2024, 15:10

241119-ska9faxelg 3

19/11/2024, 15:07

241119-shdxjsxeke 3

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Yeis 1.5/Yeis.exe
Size

2.2MB
MD5

33cbdfc88d99e1d20de14933660f2449
SHA1

35827624d55eccdd0f9f09b8fe503518090362f9
SHA256

7c1530177dbeafbef2434fcd6360215b4bef416c197ca951f220d5d0f713647f
SHA512

348f1f9d23d5a1d2a82b6fa40780e927a3c98541f2d39cfb2cf39d3c63dbf82cdb3ac9b33a290f06daed9a9d1a298bd8fa66ee85c13c643cb185a4590894725b
SSDEEP

49152:7iU1k14aizzUhMkqMWvlLls5sH3+FDnEHFmkwbvf9b4:OUqVfiK5sHug6fS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Yeis.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Yeis.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Yeis.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Yeis.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Yeis.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	Yeis.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2552	2644	Yeis.exe	30
PID 2644 wrote to memory of 2552	2644	Yeis.exe	30
PID 2644 wrote to memory of 2552	2644	Yeis.exe	30
PID 2552 wrote to memory of 2612	2552	cmd.exe	32
PID 2552 wrote to memory of 2612	2552	cmd.exe	32
PID 2552 wrote to memory of 2612	2552	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\Yeis 1.5\Yeis.exe
"C:\Users\Admin\AppData\Local\Temp\Yeis 1.5\Yeis.exe"
1⤵
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Response: {"ack":"VaultCord.com FREE Discord backup bot for members & entire server. Avoid Discord term and nukes today!","success":false,"message":"Session not found. Use latest code. You can only have app opened 1 at a time."} && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Response: {"ack":"VaultCord.com FREE Discord backup bot for members
    3⤵
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-0-0x000007FEF4EC3000-0x000007FEF4EC4000-memory.dmp

Filesize
4KB

Download
memory/2644-1-0x000000013FA00000-0x000000013FC38000-memory.dmp

Filesize
2.2MB

Download
memory/2644-2-0x000000001C020000-0x000000001C230000-memory.dmp

Filesize
2.1MB

Download
memory/2644-3-0x000007FEF4EC0000-0x000007FEF58AC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-4-0x000000001CF10000-0x000000001D124000-memory.dmp

Filesize
2.1MB

Download
memory/2644-5-0x000007FEF4EC0000-0x000007FEF58AC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-6-0x000007FEF4EC0000-0x000007FEF58AC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-7-0x000000001D230000-0x000000001D2E2000-memory.dmp

Filesize
712KB

Download
memory/2644-10-0x000007FEF4EC3000-0x000007FEF4EC4000-memory.dmp

Filesize
4KB

Download
memory/2644-11-0x000007FEF4EC0000-0x000007FEF58AC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-13-0x000007FEF4EC0000-0x000007FEF58AC000-memory.dmp

Filesize
9.9MB

Download