ytstealer | d779813711126484668391068c6845db71e7983d5b4c01a192d1208c8777e14f

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 08:15

Target

D779813711126484668391068C6845DB71E7983D5B4C01A192D1208C8777E14F.exe
Size

4.0MB
MD5

407d43e4d1bd53450b265e75cac1c7ee
SHA1

67057def6a4cc0f0ec5979c066ebd855af7dd7eb
SHA256

d779813711126484668391068c6845db71e7983d5b4c01a192d1208c8777e14f
SHA512

22e43c38130fbb5f9b312f89d060bb763fa3dbf538019123c407e9fccabb6f00df354956a67a6bac486d0b4db453e8b656162d93e620034c32b28737e8355142

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/364-54-0x00000000012E0000-0x00000000020A8000-memory.dmp	family_ytstealer
behavioral1/memory/364-57-0x00000000012E0000-0x00000000020A8000-memory.dmp	family_ytstealer

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/364-54-0x00000000012E0000-0x00000000020A8000-memory.dmp	upx
behavioral1/memory/364-57-0x00000000012E0000-0x00000000020A8000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
364	D779813711126484668391068C6845DB71E7983D5B4C01A192D1208C8777E14F.exe
364	D779813711126484668391068C6845DB71E7983D5B4C01A192D1208C8777E14F.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 332	364	D779813711126484668391068C6845DB71E7983D5B4C01A192D1208C8777E14F.exe	29
PID 364 wrote to memory of 332	364	D779813711126484668391068C6845DB71E7983D5B4C01A192D1208C8777E14F.exe	29
PID 364 wrote to memory of 332	364	D779813711126484668391068C6845DB71E7983D5B4C01A192D1208C8777E14F.exe	29
PID 332 wrote to memory of 464	332	cmd.exe	31
PID 332 wrote to memory of 464	332	cmd.exe	31
PID 332 wrote to memory of 464	332	cmd.exe	31

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/364-54-0x00000000012E0000-0x00000000020A8000-memory.dmp

Filesize
13.8MB

Download
memory/364-57-0x00000000012E0000-0x00000000020A8000-memory.dmp

Filesize
13.8MB

Download