Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
17-12-2021 17:03
Behavioral task
behavioral1
Sample
tmp/c564ac57-b926-4c6b-ba46-f4976cca36be_youtubenew1.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
tmp/c564ac57-b926-4c6b-ba46-f4976cca36be_youtubenew1.exe
-
Size
106KB
-
MD5
3211d985ee354287b4e9d8c65147004d
-
SHA1
c90a48a6f3ef9b46c3678ea5788f3f3fa7169724
-
SHA256
450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e
-
SHA512
81b85364de8e611fc051a5c4cad2a7821b1d0eee11b2e52cfbb9c45f2b8f43191fb2e9b58f9591a8c43e84140255b777ffb3d23a9a0631dc010d4a5663919ce4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c564ac57-b926-4c6b-ba46-f4976cca36be_youtubenew1.exepid process 2336 c564ac57-b926-4c6b-ba46-f4976cca36be_youtubenew1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c564ac57-b926-4c6b-ba46-f4976cca36be_youtubenew1.exedescription pid process Token: SeDebugPrivilege 2336 c564ac57-b926-4c6b-ba46-f4976cca36be_youtubenew1.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2336-115-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/2336-117-0x0000000005CE0000-0x0000000005CE1000-memory.dmpFilesize
4KB
-
memory/2336-118-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2336-119-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/2336-120-0x00000000056D0000-0x0000000005CD6000-memory.dmpFilesize
6.0MB
-
memory/2336-121-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/2336-122-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/2336-123-0x00000000067F0000-0x00000000067F1000-memory.dmpFilesize
4KB
-
memory/2336-124-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/2336-125-0x00000000062F0000-0x00000000062F1000-memory.dmpFilesize
4KB
-
memory/2336-126-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/2336-127-0x0000000006700000-0x0000000006701000-memory.dmpFilesize
4KB
-
memory/2336-128-0x00000000071E0000-0x00000000071E1000-memory.dmpFilesize
4KB
-
memory/2336-129-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/2336-130-0x0000000007600000-0x0000000007601000-memory.dmpFilesize
4KB