General
- Target yuanbao_2.72.0.613_x64.exe
- Size 50.3MB
- Sample260702-t8596ahz71
- SHA256 a65205ca49ac9a4308981ef7de0d1e5f834741ecfb6f5f2196f2ede18fc0a1cd
Malware Config
Targets
-
- Target yuanbao_2.72.0.613_x64.exe
- Size 50.3MB
- SHA256 a65205ca49ac9a4308981ef7de0d1e5f834741ecfb6f5f2196f2ede18fc0a1cd
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
- Target svc/evtutil.dll
- Size 12KB
- SHA256 a2f2616736c41213bf38e74f079dd4d57e5d72a5ab062eb38fa73b9f5480fcda
Score1/10 -
- Target svc/waitfor.exe
- Size 39KB
- SHA256 097486f5df93f449af21535b48e1ce462f7a1763051f1f206f10143b8b5a8d3e
Score1/10 -
- Target yuanbao_2.72.0.613_x64.exe
- Size 49.3MB
- SHA256 625105968857c0d658281ee089dccb20f84a9a5102e040b33a47f91d6dbb903a
Score7/10-
Modifies file permissions
-
Adds Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $0/YBContextMenu.dll
- Size 521KB
- SHA256 a1042e187a22b45e0303883cb27656a47d3dd9ad1937969eb72e49bde74e04e5
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $PLUGINSDIR/ExecDos.dll
- Size 16KB
- SHA256 74904635b831407d42e14e92c76938d0095ab3fb690998829e81090b8efcb863
Score3/10 -
- Target $PLUGINSDIR/ProductHelper.dll
- Size 499KB
- SHA256 29eba285dc948b34ddf926d82fffb746bcdb3b72f5c9f04107c48de9e76a02dd
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/ShellExecAsUser.dll
- Size 53KB
- SHA256 27151fccaedb00f9ac860ae2ab0923b52764afd57c966906aae4da044fb80372
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 19190387546863a4d4483fe07b4aec8bb2ee62274fc40766aa53e99f96d7d18b
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 dce9df2a176eab5b3deab5a8b1d533f3f2c2e577aba367399e36ad8547c47901
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 e2f06bccb38bef4039ef5d80034b4df2de5a5d1600b65a009b26a627cb0c38fb
Score3/10 -
- Target $PLUGINSDIR/nsisdl.dll
- Size 15KB
- SHA256 9555e667ba92b441f72f0ede469d07b51b51451b96dfe88e7371b8524c6037ae
Score3/10 -
- Target $WINDIR/Temp/YuanbaoUpdateService.exe
- Size 471KB
- SHA256 e6900a2ecbe9a7447d288caa56d21ef892b5b3823f848bb9cf20e12346640a41
Score3/10 -
- Target $WINDIR/Temp/report_helper.exe
- Size 787KB
- SHA256 6f94b94a8c09557eb834140bc45794d981eeeaa4fc6dee2ba6b3dd4bddc0dd9c
Score1/10 -
- Target $WINDIR/Temp/yuanbaoDeleteHelper.exe
- Size 96KB
- SHA256 4e823c5fa5ce17648930adf86826eb6c62fb796d9151c0bbe84daf16d4515c34
Score3/10 -
- Target $WINDIR/Temp/yuanbaoUpgradeHelper.exe
- Size 1.2MB
- SHA256 b1765ac1b83304709b388759f3b95303db6212bc8e2033172a009d08e80008e6
Score4/10 -
- Target $PLUGINSDIR/ExecDos.dll
- Size 16KB
- SHA256 74904635b831407d42e14e92c76938d0095ab3fb690998829e81090b8efcb863
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
3Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1