Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
17-12-2021 17:00
Behavioral task
behavioral1
Sample
tmp/ada3dbe0-38b7-4af1-a994-1320bc32e9c5_youtubenew.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
tmp/ada3dbe0-38b7-4af1-a994-1320bc32e9c5_youtubenew.exe
-
Size
106KB
-
MD5
3211d985ee354287b4e9d8c65147004d
-
SHA1
c90a48a6f3ef9b46c3678ea5788f3f3fa7169724
-
SHA256
450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e
-
SHA512
81b85364de8e611fc051a5c4cad2a7821b1d0eee11b2e52cfbb9c45f2b8f43191fb2e9b58f9591a8c43e84140255b777ffb3d23a9a0631dc010d4a5663919ce4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ada3dbe0-38b7-4af1-a994-1320bc32e9c5_youtubenew.exepid process 2324 ada3dbe0-38b7-4af1-a994-1320bc32e9c5_youtubenew.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ada3dbe0-38b7-4af1-a994-1320bc32e9c5_youtubenew.exedescription pid process Token: SeDebugPrivilege 2324 ada3dbe0-38b7-4af1-a994-1320bc32e9c5_youtubenew.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2324-118-0x0000000000AB0000-0x0000000000AB1000-memory.dmpFilesize
4KB
-
memory/2324-120-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/2324-121-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/2324-122-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/2324-123-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/2324-124-0x0000000005270000-0x0000000005876000-memory.dmpFilesize
6.0MB
-
memory/2324-125-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/2324-126-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/2324-127-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/2324-128-0x0000000006390000-0x0000000006391000-memory.dmpFilesize
4KB
-
memory/2324-129-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/2324-130-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/2324-131-0x0000000007790000-0x0000000007791000-memory.dmpFilesize
4KB
-
memory/2324-132-0x00000000079B0000-0x00000000079B1000-memory.dmpFilesize
4KB
-
memory/2324-133-0x00000000080B0000-0x00000000080B1000-memory.dmpFilesize
4KB