Edit tour
Windows
Analysis Report
YF3YnL4ksc.exe
Overview
General Information
| Sample name: | YF3YnL4ksc.exe |
| Analysis ID: | 1577203 |
| MD5: | 5fb35c53e68fc1fa0d555db9fcda099f |
| SHA1: | 828bd14a630b4ff78d5159876ab004c8fd3e63cc |
| SHA256: | 032fbff0c808c0de5d363a06a2dad711486cc4d05642858190cc3f8b0b56ba2e |
| Infos: |  |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Browser Execution In Headless Mode
Sigma detected: Browser Started with Remote Debugging
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64native
YF3YnL4ksc.exe (PID: 3368 cmdline: "C:\Users\ user\Deskt op\YF3YnL4 ksc.exe" MD5: 5FB35C53E68FC1FA0D555DB9FCDA099F) 
Job Description.exe (PID: 7432 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Job De scription. exe" MD5: C20EF77017D4930161CA76C2F2C70A8E) Rader_OS.exe (PID: 10968 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\2oHekPb Lk7CsxCvTv kEHZaSjhOq \Rader_OS. exe MD5: 0A914DEC9E5D43DFA78DBA6638491859) "C:\Users\ user\AppDa ta\Local\T emp\2oHekP bLk7CsxCvT vkEHZaSjhO q\Rader_OS .exe" --ty pe=gpu-pro cess --fie ld-trial-h andle=1320 ,511328810 2185559614 ,822341433 3412356117 ,131072 -- disable-fe atures=Lay outNG,Spar eRendererF orSitePerP rocess --g pu-prefere nces=IAAAA AAAAADgAAA gAAAAAAAAY AAAAAAACAA AAAAAAAAoA AAABAAAACA AAAAAAAAAK AAAAAAAAAA wAAAAAAAAA DgAAAAAAAA AEAAAAAAAA AAAAAAABQA AABAAAAAAA AAAAAAAAAY AAAAQAAAAA AAAAAEAAAA FAAAAEAAAA AAAAAABAAA ABgAAAA== --service- request-ch annel-toke n=14210420 1944713205 56 --mojo- platform-c hannel-han dle=1744 - -ignored=" --type=re nderer " / prefetch:2 MD5: 0A914DEC9E5D43DFA78DBA6638491859) "C:\Users\ user\AppDa ta\Local\T emp\2oHekP bLk7CsxCvT vkEHZaSjhO q\Rader_OS .exe" --ty pe=rendere r --field- trial-hand le=1320,51 1328810218 5559614,82 2341433341 2356117,13 1072 --dis able-featu res=Layout NG,SpareRe ndererForS itePerProc ess --lang =en-US --a pp-path="C :\Users\us er\AppData \Local\Tem p\2oHekPbL k7CsxCvTvk EHZaSjhOq\ resources\ app.asar" --node-int egration - -no-sandbo x --no-zyg ote --prel oad="C:\Us ers\user\A ppData\Loc al\Temp\2o HekPbLk7Cs xCvTvkEHZa SjhOq\reso urces\app. asar\prelo ad.js" --c ontext-iso lation --b ackground- color=#fff --device- scale-fact or=1 --num -raster-th reads=4 -- enable-mai n-frame-be fore-activ ation --se rvice-requ est-channe l-token=88 7292446897 4316961 -- renderer-c lient-id=4 --no-v8-u ntrusted-c ode-mitiga tions --mo jo-platfor m-channel- handle=214 4 /prefetc h:1 MD5: 0A914DEC9E5D43DFA78DBA6638491859) 
chrome.exe (PID: 8360 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --di sable-back ground-net working -- enable-fea tures=Netw orkService ,NetworkSe rviceInPro cess --dis able-backg round-time r-throttli ng --disab le-backgro unding-occ luded-wind ows --disa ble-breakp ad --disab le-client- side-phish ing-detect ion --disa ble-compon ent-extens ions-with- background -pages --d isable-def ault-apps --disable- dev-shm-us age --disa ble-extens ions --dis able-featu res=Transl ateUI,Blin kGenProper tyTrees,Im provedCook ieControls ,SameSiteB yDefaultCo okies,Lazy FrameLoadi ng --disab le-hang-mo nitor --di sable-ipc- flooding-p rotection --disable- popup-bloc king --dis able-promp t-on-repos t --disabl e-renderer -backgroun ding --dis able-sync --force-co lor-profil e=srgb --m etrics-rec ording-onl y --no-fir st-run --e nable-auto mation --p assword-st ore=basic --use-mock -keychain --user-dat a-dir=C:\U sers\user\ AppData\Lo cal\Local- Data --rem ote-debugg ing-pipe - -headless --hide-scr ollbars -- mute-audio --blink-s ettings=pr imaryHover Type=2,ava ilableHove rTypes=2,p rimaryPoin terType=4, availableP ointerType s=4 --no-s andbox --d isable-bac kground-ne tworking - -ignore-ce rtificate- errors --n o-sandbox --disable- setuid-san dbox --dis able-accel erated-2d- canvas --d isable-gpu --disable -popup-blo cking --di sable-noti fications --window-s ize=1,1 -- window-pos ition=-50, -50 --prof ile-direct ory=Defaul t about:bl ank MD5: DB46628EA19F23DEF3D3639E33431AD6) - chrome.exe (PID: 8808 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-sandb ox --ignor e-certific ate-errors --mute-au dio --igno re-certifi cate-error s --noerrd ialogs --u ser-data-d ir="C:\Use rs\user\Ap pData\Loca l\Local-Da ta" --no-s ubproc-hea p-profilin g --field- trial-hand le=1976,i, 4805155226 236665838, 1654432439 5876925011 ,262144 -- enable-fea tures=Netw orkService ,NetworkSe rviceInPro cess --dis able-featu res=BlinkG enProperty Trees,Impr ovedCookie Controls,L azyFrameLo ading,Pain tHolding,S ameSiteByD efaultCook ies,Transl ateUI --va riations-s eed-versio n=20240910 -180202.36 7000 --moj o-platform -channel-h andle=2020 /prefetch :3 MD5: DB46628EA19F23DEF3D3639E33431AD6) 
cmd.exe (PID: 1252 cmdline: C:\Windows \system32\ cmd.exe /d /s /c "ta skkill /F /IM msedge .exe /T" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1808 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
taskkill.exe (PID: 10500 cmdline: taskkill / F /IM msed ge.exe /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - cmd.exe (PID: 10564 cmdline:
C:\Windows \system32\ cmd.exe /d /s /c "ta skkill /F /IM msedge .exe /T" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 10592 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - taskkill.exe (PID: 10492 cmdline:
taskkill / F /IM msed ge.exe /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - cmd.exe (PID: 10872 cmdline:
C:\Windows \system32\ cmd.exe /d /s /c "ta skkill /F /IM msedge .exe /T" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2116 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - taskkill.exe (PID: 9880 cmdline:
taskkill / F /IM msed ge.exe /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - cmd.exe (PID: 3392 cmdline:
C:\Windows \system32\ cmd.exe /d /s /c "ta skkill /F /IM msedge .exe /T" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 10344 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - taskkill.exe (PID: 8152 cmdline:
taskkill / F /IM msed ge.exe /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - cmd.exe (PID: 7668 cmdline:
C:\Windows \system32\ cmd.exe /d /s /c "ta skkill /F /IM msedge .exe /T" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6552 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - taskkill.exe (PID: 10084 cmdline:
taskkill / F /IM msed ge.exe /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) 
msedge.exe (PID: 1972 cmdline: "C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --disab le-backgro und-networ king --ena ble-featur es=Network Service,Ne tworkServi ceInProces s --disabl e-backgrou nd-timer-t hrottling --disable- background ing-occlud ed-windows --disable -breakpad --disable- client-sid e-phishing -detection --disable -component -extension s-with-bac kground-pa ges --disa ble-defaul t-apps --d isable-dev -shm-usage --disable -extension s --disabl e-features =Translate UI,BlinkGe nPropertyT rees,Impro vedCookieC ontrols,Sa meSiteByDe faultCooki es,LazyFra meLoading --disable- hang-monit or --disab le-ipc-flo oding-prot ection --d isable-pop up-blockin g --disabl e-prompt-o n-repost - -disable-r enderer-ba ckgroundin g --disabl e-sync --f orce-color -profile=s rgb --metr ics-record ing-only - -no-first- run --enab le-automat ion --pass word-store =basic --u se-mock-ke ychain "-- user-data- dir=C:\Use rs\user\Ap pData\Loca l\Microsof t\Edge\Use r Data" -- remote-deb ugging-pip e --headle ss --hide- scrollbars --mute-au dio --blin k-settings =primaryHo verType=2, availableH overTypes= 2,primaryP ointerType =4,availab lePointerT ypes=4 --n o-sandbox --disable- background -networkin g --ignore -certifica te-errors --no-sandb ox --disab le-setuid- sandbox -- disable-ac celerated- 2d-canvas --disable- gpu --disa ble-popup- blocking - -disable-n otificatio ns --windo w-size=1,1 --window- position=- 50,-50 --p rofile-dir ectory=Def ault about :blank MD5: F755556B2CE14570A86FB983EEA72F97) - msedge.exe (PID: 10716 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-US - -service-s andbox-typ e=none --n o-sandbox --ignore-c ertificate -errors -- mute-audio --ignore- certificat e-errors - -noerrdial ogs --user -data-dir= "C:\Users\ user\AppDa ta\Local\M icrosoft\E dge\User D ata" --fie ld-trial-h andle=2016 ,i,1363429 9322002045 715,680555 4880547277 524,262144 --enable- features=N etworkServ ice,Networ kServiceIn Process,ms MetricsLog FastStartu p,msSendMe tricsLogOn Close --di sable-feat ures=Blink GenPropert yTrees,Imp rovedCooki eControls, LazyFrameL oading,Pai ntHolding, SameSiteBy DefaultCoo kies,Trans lateUI --v ariations- seed-versi on --mojo- platform-c hannel-han dle=2032 / prefetch:3 MD5: F755556B2CE14570A86FB983EEA72F97) - msedge.exe (PID: 4712 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=ass et_store.m ojom.Asset StoreServi ce --lang= en-US --se rvice-sand box-type=a sset_store _service - -no-sandbo x --ignore -certifica te-errors --mute-aud io --ignor e-certific ate-errors --noerrdi alogs --us er-data-di r="C:\User s\user\App Data\Local \Microsoft \Edge\User Data" --f ield-trial -handle=45 52,i,13634 2993220020 45715,6805 5548805472 77524,2621 44 --enabl e-features =NetworkSe rvice,Netw orkService InProcess, msMetricsL ogFastStar tup,msSend MetricsLog OnClose -- disable-fe atures=Bli nkGenPrope rtyTrees,I mprovedCoo kieControl s,LazyFram eLoading,P aintHoldin g,SameSite ByDefaultC ookies,Tra nslateUI - -variation s-seed-ver sion --moj o-platform -channel-h andle=4568 /prefetch :8 MD5: F755556B2CE14570A86FB983EEA72F97) - msedge.exe (PID: 3632 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=ent ity_extrac tion_servi ce.mojom.E xtractor - -lang=en-U S --servic e-sandbox- type=entit y_extracti on --no-sa ndbox --ig nore-certi ficate-err ors --mute -audio --i gnore-cert ificate-er rors --onn x-enabled- for-ee --n oerrdialog s --user-d ata-dir="C :\Users\us er\AppData \Local\Mic rosoft\Edg e\User Dat a" --field -trial-han dle=4572,i ,136342993 2200204571 5,68055548 8054727752 4,262144 - -enable-fe atures=Net workServic e,NetworkS erviceInPr ocess,msMe tricsLogFa stStartup, msSendMetr icsLogOnCl ose --disa ble-featur es=BlinkGe nPropertyT rees,Impro vedCookieC ontrols,La zyFrameLoa ding,Paint Holding,Sa meSiteByDe faultCooki es,Transla teUI --var iations-se ed-version --mojo-pl atform-cha nnel-handl e=4728 /pr efetch:8 MD5: F755556B2CE14570A86FB983EEA72F97) "C:\Users\ user\AppDa ta\Local\T emp\2oHekP bLk7CsxCvT vkEHZaSjhO q\Rader_OS .exe" --ty pe=rendere r --field- trial-hand le=1320,51 1328810218 5559614,82 2341433341 2356117,13 1072 --dis able-featu res=Layout NG,SpareRe ndererForS itePerProc ess --lang =en-US --a pp-path="C :\Users\us er\AppData \Local\Tem p\2oHekPbL k7CsxCvTvk EHZaSjhOq\ resources\ app.asar" --no-sandb ox --no-zy gote --bac kground-co lor=#fff - -device-sc ale-factor =1 --num-r aster-thre ads=4 --en able-main- frame-befo re-activat ion --serv ice-reques t-channel- token=1827 1155812633 344397 --r enderer-cl ient-id=6 --no-v8-un trusted-co de-mitigat ions --moj o-platform -channel-h andle=2224 /prefetch :1 MD5: 0A914DEC9E5D43DFA78DBA6638491859) "C:\Users\ user\AppDa ta\Local\T emp\2oHekP bLk7CsxCvT vkEHZaSjhO q\Rader_OS .exe" --ty pe=gpu-pro cess --fie ld-trial-h andle=1320 ,511328810 2185559614 ,822341433 3412356117 ,131072 -- disable-fe atures=Lay outNG,Spar eRendererF orSitePerP rocess --d isable-gpu -sandbox - -use-gl=di sabled --g pu-prefere nces=IAAAA AAAAADgAAA gAAAAAAAAY AAAAAAACAA AAAAAAAAoA AAABAAAACA AAAAAAAAAK AAAAAAAAAA wAAAAAAAAA DgAAAAAAAA AEAAAAAAAA AAAAAAABQA AABAAAAAAA AAAAAAAAAY AAAAQAAAAA AAAAAEAAAA FAAAAEAAAA AAAAAABAAA ABgAAAA== --service- request-ch annel-toke n=13805994 1542442138 03 --mojo- platform-c hannel-han dle=2852 / prefetch:2 MD5: 0A914DEC9E5D43DFA78DBA6638491859) 
AcroRd32.exe (PID: 5824 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroR d32.exe" " C:\Users\u ser\AppDat a\Local\Te mp\Adverti sing_Campa ign_Manage r_Role_v2. pdf" MD5: 0F4FB7ADA3C27236864D008A1687AD8D) 
RdrCEF.exe (PID: 9288 cmdline: "C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroC EF\RdrCEF. exe" --bac kgroundcol or=1677721 5 MD5: 35AF5C1FA6FAC9569BB3FF6654A7152E) - RdrCEF.exe (PID: 9456 cmdline:
"C:\Progra m Files (x 86)\Adobe\ Acrobat Re ader DC\Re ader\AcroC EF\RdrCEF. exe" --typ e=utility --utility- sub-type=n etwork.moj om.Network Service -- lang=en-US --service -sandbox-t ype=none - -log-sever ity=disabl e --user-a gent-produ ct="Reader Services/2 3.3.20269 Chrome/105 .0.0.0" -- lang=en-US --user-da ta-dir="C: \Users\use r\AppData\ Local\CEF\ User Data" --log-fil e="C:\Prog ram Files (x86)\Adob e\Acrobat Reader DC\ Reader\Acr oCEF\debug .log" --mo jo-platfor m-channel- handle=224 4 --field- trial-hand le=1664,i, 1130639604 9912346103 ,145965774 9850093734 0,131072 - -disable-f eatures=Ba ckForwardC ache,Calcu lateNative WinOcclusi on,WinUseB rowserSpel lChecker / prefetch:8 MD5: 35AF5C1FA6FAC9569BB3FF6654A7152E) - crypted.exe (PID: 6580 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\crypte d.exe" MD5: B48C9F368745E6D89288BD4D40F3AADE) - conhost.exe (PID: 5304 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
MSBuild.exe (PID: 7512 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\MSB uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232) 
WerFault.exe (PID: 7428 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 580 -s 324 MD5: 40A149513D721F096DDF50C04DA2F01F)
- elevation_service.exe (PID: 10804 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \128.0.273 9.63\eleva tion_servi ce.exe" MD5: F557D8ABB5984175B3409105002C16D9)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Nasreddine Bencherchali (Nextron Systems): | ||