Analysis
- max time kernel
40s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 22:39
General
- Target yuanbao.exe
- Size 21.8MB
- Sample260720-2k8dlsh121
- SHA256 bca78e472cdf94c16fd67cdf2894d7286c17b370007878b988b9a9f9705f99d5
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\yuanbao.exe"C:\Users\Admin\AppData\Local\Temp\yuanbao.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1yuanbao.exe"C:\Users\Admin\AppData\Local\Temp\1yuanbao.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2Lj0NI.exe"C:\Users\Admin\AppData\Local\Temp\2Lj0NI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-J4LJN.tmp\2Lj0NI.tmp"C:\Users\Admin\AppData\Local\Temp\is-J4LJN.tmp\2Lj0NI.tmp" /SL5="$6009E,18118582,875520,C:\Users\Admin\AppData\Local\Temp\2Lj0NI.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\msys64\FCJPX\yzrvzJ\P1u6\7uYq\GmdEx.exe"C:\msys64\FCJPX\yzrvzJ\P1u6\7uYq\GmdEx.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1yuanbao.exe
2Lj0NI.exe
2Lj0NI.tmp
GmdEx.exe
Nmg5t7d.H
uJQ.2w
memory/948-59-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-53-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-60-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-62-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-60-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-59-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-55-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-62-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-55-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/948-53-0x00000276CCA90000-0x00000276CF064000-memory.dmp
memory/2860-38-0x0000000000400000-0x0000000000705000-memory.dmp
memory/2860-38-0x0000000000400000-0x0000000000705000-memory.dmp
memory/3360-0-0x0000000000400000-0x000000000049D000-memory.dmp
memory/3360-0-0x0000000000400000-0x000000000049D000-memory.dmp
memory/3876-51-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-50-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-43-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-45-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-49-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-43-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-45-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-49-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-52-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-51-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-50-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/3876-52-0x000001938A910000-0x000001938CEE4000-memory.dmp
memory/4668-39-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/4668-39-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/4668-21-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/4668-21-0x0000000000400000-0x00000000004E3000-memory.dmp