ytstealer | efd2f077a353eaa4b72ca2bc038464a32c82cd84717d8d8fa50fdb77b9a4d736

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 08:21

Target

EFD2F077A353EAA4B72CA2BC038464A32C82CD84717D8D8FA50FDB77B9A4D736.exe
Size

4.0MB
MD5

0fe145975973cea3a7c3aa5be08e721d
SHA1

d9dab19a64bc01fd1147531f11e9440731745af0
SHA256

efd2f077a353eaa4b72ca2bc038464a32c82cd84717d8d8fa50fdb77b9a4d736
SHA512

4c2f3a26383351df9d79726aa9230a96bb5c7d89f9dc18475e002e8fab5bd02d99d8cbceeba51a41c87003c5c6ac1e8ee692abae55754cb4558e4b6035cfc690

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/944-54-0x00000000011D0000-0x0000000001F99000-memory.dmp	family_ytstealer
behavioral1/memory/944-57-0x00000000011D0000-0x0000000001F99000-memory.dmp	family_ytstealer

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/944-54-0x00000000011D0000-0x0000000001F99000-memory.dmp	upx
behavioral1/memory/944-57-0x00000000011D0000-0x0000000001F99000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
944	EFD2F077A353EAA4B72CA2BC038464A32C82CD84717D8D8FA50FDB77B9A4D736.exe
944	EFD2F077A353EAA4B72CA2BC038464A32C82CD84717D8D8FA50FDB77B9A4D736.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 588	944	EFD2F077A353EAA4B72CA2BC038464A32C82CD84717D8D8FA50FDB77B9A4D736.exe	28
PID 944 wrote to memory of 588	944	EFD2F077A353EAA4B72CA2BC038464A32C82CD84717D8D8FA50FDB77B9A4D736.exe	28
PID 944 wrote to memory of 588	944	EFD2F077A353EAA4B72CA2BC038464A32C82CD84717D8D8FA50FDB77B9A4D736.exe	28
PID 588 wrote to memory of 268	588	cmd.exe	30
PID 588 wrote to memory of 268	588	cmd.exe	30
PID 588 wrote to memory of 268	588	cmd.exe	30

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/944-54-0x00000000011D0000-0x0000000001F99000-memory.dmp

Filesize
13.8MB

Download
memory/944-57-0x00000000011D0000-0x0000000001F99000-memory.dmp

Filesize
13.8MB

Download