9c4dbf2cc6c32c8758338271c02a242a0f1a2b43793bbfec12ee670d8af0e7b1

Submit
Reports

Overview

overview

Static

static

yilu_win64/init.bat

windows7-x64

yilu_win64/init.bat

windows10-2004-x64

yilu_win64...ce.exe

windows7-x64

yilu_win64...ce.exe

windows10-2004-x64

yilu_win64/start.bat

windows7-x64

yilu_win64/start.bat

windows10-2004-x64

yilu_win64/stop.bat

windows7-x64

yilu_win64/stop.bat

windows10-2004-x64

yilu_win64...CL.dll

windows7-x64

yilu_win64...CL.dll

windows10-2004-x64

yilu_win64...ta.exe

windows7-x64

yilu_win64...ta.exe

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...-0.dll

windows10-2004-x64

yilu_win64...40.dll

windows7-x64

yilu_win64...40.dll

windows10-2004-x64

yilu_win64...te.exe

windows7-x64

yilu_win64...te.exe

windows10-2004-x64

yilu_win64...40.dll

windows7-x64

yilu_win64...40.dll

windows10-2004-x64

yilu_win64...80.dll

windows7-x64

yilu_win64...80.dll

windows10-2004-x64

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 19:51

Sharing

Copy URL

Twitter E-mail

Static task

static1

miner xmrig

3 signatures

Behavioral task

behavioral1

Sample

yilu_win64/init.bat

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

yilu_win64/init.bat

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

yilu_win64/mservice.exe

Resource

win7-20241023-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

yilu_win64/mservice.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

yilu_win64/start.bat

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

yilu_win64/start.bat

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

yilu_win64/stop.bat

Resource

win7-20241010-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

yilu_win64/stop.bat

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

yilu_win64/work/protecta/OpenCL.dll

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

yilu_win64/work/protecta/OpenCL.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

yilu_win64/work/protecta/protecta.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

yilu_win64/work/protecta/protecta.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

yilu_win64/work/protecte/api-ms-win-crt-convert-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

yilu_win64/work/protecte/api-ms-win-crt-environment-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

yilu_win64/work/protecte/api-ms-win-crt-filesystem-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

yilu_win64/work/protecte/api-ms-win-crt-heap-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

yilu_win64/work/protecte/api-ms-win-crt-locale-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

yilu_win64/work/protecte/api-ms-win-crt-math-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

yilu_win64/work/protecte/api-ms-win-crt-multibyte-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

yilu_win64/work/protecte/api-ms-win-crt-runtime-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

yilu_win64/work/protecte/api-ms-win-crt-stdio-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

yilu_win64/work/protecte/api-ms-win-crt-string-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

yilu_win64/work/protecte/api-ms-win-crt-time-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

yilu_win64/work/protecte/api-ms-win-crt-utility-l1-1-0.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

yilu_win64/work/protecte/msvcp140.dll

Resource

win7-20241010-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

yilu_win64/work/protecte/msvcp140.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

yilu_win64/work/protecte/protecte.exe

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

yilu_win64/work/protecte/protecte.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

yilu_win64/work/protecte/vcruntime140.dll

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

yilu_win64/work/protecte/vcruntime140.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

yilu_win64/work/protectn/nvrtc-builtins64_80.dll

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral32

Sample

yilu_win64/work/protectn/nvrtc-builtins64_80.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

yilu_win64/stop.bat
Size

591B
MD5

9a00b71d42f4ed27e5aa1714b7e72b7c
SHA1

ac775885d291868e3b150ac8246942e42882f3de
SHA256

147be22acd696738965958862ed6049b13814e2edae89e3d75ffe3b3e86bbda7
SHA512

c0165e0ab11b35aaf04dc12fad7be557602dae0d9ca183607110362f0177f9892189af478fdebc316b6a46f14d5b67925acc00698d43e788f6324b4e44d0e903

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2880	2252	cmd.exe	31
PID 2252 wrote to memory of 2880	2252	cmd.exe	31
PID 2252 wrote to memory of 2880	2252	cmd.exe	31
PID 2252 wrote to memory of 2884	2252	cmd.exe	32
PID 2252 wrote to memory of 2884	2252	cmd.exe	32
PID 2252 wrote to memory of 2884	2252	cmd.exe	32
PID 2252 wrote to memory of 2212	2252	cmd.exe	33
PID 2252 wrote to memory of 2212	2252	cmd.exe	33
PID 2252 wrote to memory of 2212	2252	cmd.exe	33

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\yilu_win64\stop.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\mode.com
  mode con cols=100 lines=20
  2⤵
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\yilu_win64\mservice.exe
  mservice.exe -service stop
  2⤵
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\yilu_win64\mservice.exe
  mservice.exe -service uninstall
  2⤵
  PID:2212

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads