Analysis
- max time kernel
899s - max time network
437s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
YUMI.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
YUMI.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
29 signatures
900 seconds
Behavioral task
behavioral3
Sample
YUMI/YUMI.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
YUMI/YUMI.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
900 seconds
Behavioral task
behavioral5
Sample
YUMI/license.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
YUMI/license.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
General
- Target YUMI/YUMI.exe
- Size 4.3MB
- Sample260913-ldly2axvbx
- SHA256 dbdc81bacde0aabecc19512e2c91e5ebddc62d7665942ccd87256d6e41b0d6ed
- MD5 0c19387305678d903dcfc3499cae1cdc
- SHA1 d9be36c0399d6f6b7c7e3e174dc9d205589c4739
- SHA512 2a9661d40958e13bd8f0914d855816ca82e2697213bbe53d4d5c9daf62857ca78e89822e94cc78e314cd1da59c2667a2fb498f18d613a96c4464e33c362eec67
- SSDEEP 98304:izl82NLwSMSVdsskgGSVwSBZQDA5S1u27Sl:iBZDjkMVwSBZQDA5SAl
- TLSH T17026D056F2FA40FDD276D03CC6A79217E6B17414173587DB23E08A22AFA3AD08E79711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1860 YUMI.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4124 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe 1860 YUMI.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1860 wrote to memory of 4124 1860 YUMI.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\YUMI\YUMI.exe"C:\Users\Admin\AppData\Local\Temp\YUMI\YUMI.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:4124
-