Analysis
- user interaction
yes - max time kernel
114s - max time network
121s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
11/10/2026, 02:20
General
- Target YCS-Repair1.3.exe
- Size 145.5MB
- Sample261011-csv1tatzgx
- SHA256 18427928af4bc0674dd56953c16625b1994229df1479f5c7afe28f15a478f6c5
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 29 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YCS-Repair1.3.exe"C:\Users\Admin\AppData\Local\Temp\YCS-Repair1.3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-P2KVE.tmp\YCS-Repair1.3.tmp"C:\Users\Admin\AppData\Local\Temp\is-P2KVE.tmp\YCS-Repair1.3.tmp" /SL5="$601CE,151798211,984064,C:\Users\Admin\AppData\Local\Temp\YCS-Repair1.3.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\YCS-Repair\YCS-Repair.exe"C:\Program Files (x86)\YCS-Repair\YCS-Repair.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BitmapPosition.ini
BitmapViewer.dll
MultiLayerBitmapViewer.dll
PdfViewForm.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Svg.dll
Qt5Widgets.dll
UsbdogDll.dll
VideoViewForm.dll
YCS-Repair.exe
qgenericbearer.dll
qsvgicon.dll
qgif.dll
qicns.dll
qico.dll
qjpeg.dll
qsvg.dll
qtga.dll
qtiff.dll
qwbmp.dll
qwebp.dll
zh.qm
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
is-V4PH4.tmp
pdfium.dll
qwindows.dll
qwindowsvistastyle.dll
version.dat
YCS-Repair1.3.tmp
memory/1600-2187-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1600-0-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1600-54-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/4388-2186-0x0000000000400000-0x00000000006BD000-memory.dmp
memory/4388-1454-0x0000000000400000-0x00000000006BD000-memory.dmp
memory/4388-55-0x0000000000400000-0x00000000006BD000-memory.dmp
memory/4388-56-0x0000000002570000-0x0000000002571000-memory.dmp
memory/4388-5-0x0000000002570000-0x0000000002571000-memory.dmp
memory/4512-2229-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2267-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2185-0x0000000067780000-0x00000000677A2000-memory.dmp
memory/4512-2173-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2227-0x0000000065800000-0x000000006581B000-memory.dmp
memory/4512-2228-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2226-0x000000006D400000-0x000000006D496000-memory.dmp
memory/4512-2172-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2225-0x00000000667C0000-0x000000006688B000-memory.dmp
memory/4512-2224-0x000000006B2C0000-0x000000006B31F000-memory.dmp
memory/4512-2223-0x0000000000400000-0x0000000000B91000-memory.dmp
memory/4512-2231-0x000000006EB40000-0x000000006EB62000-memory.dmp
memory/4512-2233-0x0000000064B40000-0x0000000064B54000-memory.dmp
memory/4512-2239-0x0000000004160000-0x0000000004170000-memory.dmp
memory/4512-2238-0x0000000001B60000-0x0000000001B72000-memory.dmp
memory/4512-2237-0x0000000067780000-0x00000000677A2000-memory.dmp
memory/4512-2236-0x000000006CE40000-0x000000006CE78000-memory.dmp
memory/4512-2232-0x000000006FE40000-0x000000006FFBF000-memory.dmp
memory/4512-2230-0x0000000069900000-0x0000000069AD4000-memory.dmp
memory/4512-2235-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2234-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2252-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2253-0x000000006CE40000-0x000000006CE78000-memory.dmp
memory/4512-2251-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2245-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2246-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2274-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2275-0x000000006CE40000-0x000000006CE78000-memory.dmp
memory/4512-2273-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2199-0x0000000001B60000-0x0000000001B72000-memory.dmp
memory/4512-2268-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2262-0x0000000000400000-0x0000000000B91000-memory.dmp
memory/4512-2285-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2291-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2290-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2284-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2301-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2309-0x000000006CE40000-0x000000006CE78000-memory.dmp
memory/4512-2308-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2307-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2302-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2319-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2325-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2324-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2318-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2337-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2343-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2336-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2342-0x00000000013C0000-0x00000000019D0000-memory.dmp
memory/4512-2354-0x0000000061B40000-0x00000000621EA000-memory.dmp
memory/4512-2360-0x000000006AA80000-0x000000006AC6D000-memory.dmp
memory/4512-2353-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2365-0x0000000000400000-0x0000000000B91000-memory.dmp
memory/4512-2370-0x0000000068A80000-0x00000000690DA000-memory.dmp
memory/4512-2369-0x0000000065800000-0x000000006581B000-memory.dmp
memory/4512-2368-0x000000006D400000-0x000000006D496000-memory.dmp
memory/4512-2367-0x00000000667C0000-0x000000006688B000-memory.dmp
memory/4512-2366-0x000000006B2C0000-0x000000006B31F000-memory.dmp