9edbc29d5892efa1e1d95dfd2d8fcebb6d32c02a8df5ca8374ac8ddb199e292a

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yank-x64.exe
Size 2.8MB
Sample260803-aghj8svarb
SHA256 9edbc29d5892efa1e1d95dfd2d8fcebb6d32c02a8df5ca8374ac8ddb199e292a
MD5 45afafe72a6be35fd9a729f71bfb1ffc
SHA1 530819ad4195e809d33a6c464c7e5257c173e6dc
SHA512 2dc7f650b960a97e9c60fefa364c1f90132c25b6df2af3959e1b26b157df058a5947863ac1aeb251c981c6b0a1fa6a3f62de8f6eadd26b4e3440d943bd2eae28
SSDEEP 49152:KqGPYqJdXkOJiFpe/1CmBo+xp1cXQDd7H7GZjAkjDOnDuQ+7XA:KdRJhcXQD1GZjAkjixiQ
TLSH
T170D59E16B3F8046ED5AF8338C422560BD7B1F4055721EBCB569086AC2F63BE24E76376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4372	Yank-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4372	Yank-x64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	Yank-x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4372	Yank-x64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4372	Yank-x64.exe

C:\Users\Admin\AppData\Local\Temp\Yank-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Yank-x64.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e_sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Yank-x64\da0oHJxdqhFJiddxbVKYHPu+_BuxVLw=\e_sqlite3.dll
Size 1.6MB
SHA256 dccbabb2bc7e7d4302c44d9ce41b70721a7d0914fa4d289e2f340d39766ad102
MD5 d93fc939cf4c875fc065c37e771da367
SHA1 5a035170e758c13913a41cc427de556485c5ef5d
SHA512 e442dc97c14522e675067a85589698b657b43aeff91bbd75efc2db8fd7bbd0c5939dece270eb0fc4c108113b1246ce7268f8f38fd63c754f364d19dec40551e2
SSDEEP 49152:KFpe/1CmBo+xp1cXQDd7H7GZjAkjDOnDuQ+7X:7JhcXQD1GZjAkjixi
TLSH
T1BA758D47A7B900ACD8A7C27885179707D7F170051764ABEB55A08AA92F23FF61F7A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download