Analysis
- user interaction
yes - max time kernel
74s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/08/2026, 04:18
General
- Target yumi_py-1.0.5.exe
- Size 28.1MB
- Sample260810-ew1ftavya1
- SHA256 1ec3c99d7ae4478d3a9f714e8dbad65396a2bae5547cfcd0f209fa97fd823c12
Malware Config
Signatures
- Loads dropped DLL 19 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\yumi_py-1.0.5.exe"C:\Users\Admin\AppData\Local\Temp\yumi_py-1.0.5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yumi_py-1.0.5.exeC:\Users\Admin\AppData\Local\Temp\yumi_py-1.0.5.exe2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "$disks = Get-CimInstance Win32_LogicalDisk | Select-Object DeviceID,VolumeName,FileSystem,Size,FreeSpace,DriveType;$assoc = Get-CimInstance Win32_LogicalDiskToPartition | Select-Object @{n='PartitionId';e={$_.Antecedent.DeviceID}},@{n='DriveLetter';e={$_.Dependent.DeviceID}};[PSCustomObject]@{Disks=$disks; Assoc=$assoc} | ConvertTo-Json -Compress -Depth 4"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic logicaldisk get DeviceID,VolumeName,FileSystem,Size,FreeSpace,DriveType3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_LogicalDiskToPartition get Antecedent,Dependent3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic path Win32_LogicalDiskToPartition get Antecedent,Dependent3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Get-Partition | Where-Object { $_.DriveLetter } | Select-Object DriveLetter,DiskNumber | ConvertTo-Json -Compress"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_DiskDrive | Select-Object Index,Size,Partitions,InterfaceType | ConvertTo-Json -Compress"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4ntoftaf.f1y.ps1
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_tkinter.pyd
_uuid.pyd
distros.json
iso_sources.json
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
python39.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
tk86t.dll
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
scrlbar.tcl
spinbox.tcl
text.tcl
tk.tcl
cursors.tcl
fonts.tcl
ttk.tcl
utils.tcl
yumi_gui.dll
memory/2168-1205-0x000002281C4A0000-0x000002281D233000-memory.dmp
memory/2168-1258-0x000002281C4A0000-0x000002281D233000-memory.dmp
memory/2168-1262-0x000002281C4A0000-0x000002281D233000-memory.dmp
memory/2168-1261-0x000002281C4A0000-0x000002281D233000-memory.dmp
memory/2168-1260-0x000002281C4A0000-0x000002281D233000-memory.dmp
memory/2168-1259-0x000002281C4A0000-0x000002281D233000-memory.dmp
memory/2280-1223-0x00000201798C0000-0x00000201798EA000-memory.dmp
memory/2280-1225-0x0000020179A90000-0x0000020179C52000-memory.dmp
memory/2280-1226-0x000002017A190000-0x000002017A6B8000-memory.dmp
memory/2280-1224-0x00000201798C0000-0x00000201798E4000-memory.dmp
memory/2280-1209-0x0000020161170000-0x0000020161192000-memory.dmp
memory/2280-1222-0x0000020179600000-0x000002017960A000-memory.dmp
memory/2280-1221-0x0000020179540000-0x00000201795F3000-memory.dmp
memory/2280-1220-0x0000020179520000-0x000002017953C000-memory.dmp
memory/5384-1241-0x000001E91CDA0000-0x000001E91CDBC000-memory.dmp
memory/5384-1242-0x000001E91CD80000-0x000001E91CD8A000-memory.dmp
memory/5384-1243-0x000001E91CD90000-0x000001E91CD9A000-memory.dmp