ytstealer | 24721a4f863d03ebd776588ce9723c2f463db6b39d83787edf3ae16d6490a46c

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20/07/2022, 07:33

Target

24721A4F863D03EBD776588CE9723C2F463DB6B39D83787EDF3AE16D6490A46C.exe
Size

4.0MB
MD5

c0b2c318ed4532b8255413da7cb10316
SHA1

cc85fe48edf93d0aab2224e79d36c77dedb511fe
SHA256

24721a4f863d03ebd776588ce9723c2f463db6b39d83787edf3ae16d6490a46c
SHA512

0f1bab9eacf3ae2e4d280f7b42137a9af0f3b7eecc2b0df5796b35bdab8ee236a769a287104449ecaea3f1a49f72672f23a8b72bb9389c0bc5bdbd193f2b9771

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/1480-54-0x0000000000980000-0x0000000001748000-memory.dmp	family_ytstealer
behavioral1/memory/1480-57-0x0000000000980000-0x0000000001748000-memory.dmp	family_ytstealer

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1480-54-0x0000000000980000-0x0000000001748000-memory.dmp	upx
behavioral1/memory/1480-57-0x0000000000980000-0x0000000001748000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1480	24721A4F863D03EBD776588CE9723C2F463DB6B39D83787EDF3AE16D6490A46C.exe
1480	24721A4F863D03EBD776588CE9723C2F463DB6B39D83787EDF3AE16D6490A46C.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 320	1480	24721A4F863D03EBD776588CE9723C2F463DB6B39D83787EDF3AE16D6490A46C.exe	29
PID 1480 wrote to memory of 320	1480	24721A4F863D03EBD776588CE9723C2F463DB6B39D83787EDF3AE16D6490A46C.exe	29
PID 1480 wrote to memory of 320	1480	24721A4F863D03EBD776588CE9723C2F463DB6B39D83787EDF3AE16D6490A46C.exe	29
PID 320 wrote to memory of 912	320	cmd.exe	31
PID 320 wrote to memory of 912	320	cmd.exe	31
PID 320 wrote to memory of 912	320	cmd.exe	31

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1480-54-0x0000000000980000-0x0000000001748000-memory.dmp

Filesize
13.8MB

Download
memory/1480-57-0x0000000000980000-0x0000000001748000-memory.dmp

Filesize
13.8MB

Download