Analysis
-
max time kernel
14s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:05
Static task
static1
Behavioral task
behavioral1
Sample
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe
Resource
win10v2004-20240508-en
General
-
Target
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe
-
Size
144KB
-
MD5
1712b04615487183ff0753de33fa0ab1
-
SHA1
50fc233560cc0f368931ca5b47b7a689742f6ff2
-
SHA256
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2
-
SHA512
6009df48809ce21225cf08565184ee6656d2cea59c306317f0c121310630e4b8f904f90c9328458c50885dde3c6d3848112784dcfa6b637a041c99d64a6f9166
-
SSDEEP
3072:l5SVkkgUgXC7AdYzrV+Dljy/32ubwZ/qJ:SUFCkdYzrVolu/J0Z/
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 7 IoCs
Processes:
resource yara_rule behavioral2/memory/2424-12-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2424-9-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2424-8-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2424-2-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2424-36-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/2424-51-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/memory/4748-53-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe -
Processes:
resource yara_rule behavioral2/memory/2424-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2424-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2424-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2424-2-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2424-36-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2424-51-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4748-53-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exedescription pid process target process PID 1944 set thread context of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exee8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exepid process 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe 2424 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exee8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.execmd.exedescription pid process target process PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 1944 wrote to memory of 2424 1944 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe PID 2424 wrote to memory of 4816 2424 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe cmd.exe PID 2424 wrote to memory of 4816 2424 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe cmd.exe PID 2424 wrote to memory of 4816 2424 e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe cmd.exe PID 4816 wrote to memory of 2776 4816 cmd.exe reg.exe PID 4816 wrote to memory of 2776 4816 cmd.exe reg.exe PID 4816 wrote to memory of 2776 4816 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe"C:\Users\Admin\AppData\Local\Temp\e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe"C:\Users\Admin\AppData\Local\Temp\e8d0e23d5aa07643065509a781685239885b04a3d39d78aa537e3dc3ae5075a2.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YUVIO.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\YUVIO.txtFilesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exeFilesize
144KB
MD5b48b37b0a91f6ee15f9a663939be889e
SHA12a3a64f42894542fa18c57aef215199433701c80
SHA256739f69602e839b5ba1663113b9552b1e75fabc0a2aae5b4ecdbd8f0eb40a3f3a
SHA5128e9d198b4d3d740ba3cfd9ddb1cc85cd09c613d4b5617f9c7c6c85d5cc7994f77da3d53eb72b33736f1358d14865db11fce5826d2d00aeafa0e0d66f60963f8a
-
memory/1372-40-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1372-50-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1856-44-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1856-54-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1856-41-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1856-45-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1856-47-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1944-6-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/1944-5-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/1944-7-0x0000000002AF0000-0x0000000002AF1000-memory.dmpFilesize
4KB
-
memory/2424-36-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2424-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2424-51-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2424-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2424-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2424-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4748-53-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB