ytstealer | 6cb421e2a0c187016e243d0bee3bff810cc6d57d760cb14c13a41156224a2398

Analysis

max time kernel
53s
max time network
181s
platform
windows10-1703_x64
resource
win10-20220718-en
resource tags

arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system
submitted
20/07/2022, 08:04

Target

6CB421E2A0C187016E243D0BEE3BFF810CC6D57D760CB14C13A41156224A2398.exe
Size

4.0MB
MD5

626c9bc075583c1f87e0283f23159f16
SHA1

4f1a331aa8d7bd78313ec9eebdee727d4f560866
SHA256

6cb421e2a0c187016e243d0bee3bff810cc6d57d760cb14c13a41156224a2398
SHA512

49d3f590d0c19526c2bb51dfda53b27c03f5414d47fac4116f6bc4b61f372e6d7327de967f65e17482a13174ba23b7f40db95b4fba1b09166f25a853f8fcc7c2

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/2144-114-0x0000000000CD0000-0x0000000001A98000-memory.dmp	family_ytstealer
behavioral2/memory/2144-117-0x0000000000CD0000-0x0000000001A98000-memory.dmp	family_ytstealer

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2144-114-0x0000000000CD0000-0x0000000001A98000-memory.dmp	upx
behavioral2/memory/2144-117-0x0000000000CD0000-0x0000000001A98000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2144	6CB421E2A0C187016E243D0BEE3BFF810CC6D57D760CB14C13A41156224A2398.exe
2144	6CB421E2A0C187016E243D0BEE3BFF810CC6D57D760CB14C13A41156224A2398.exe
2144	6CB421E2A0C187016E243D0BEE3BFF810CC6D57D760CB14C13A41156224A2398.exe
2144	6CB421E2A0C187016E243D0BEE3BFF810CC6D57D760CB14C13A41156224A2398.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1932	2144	6CB421E2A0C187016E243D0BEE3BFF810CC6D57D760CB14C13A41156224A2398.exe	67
PID 2144 wrote to memory of 1932	2144	6CB421E2A0C187016E243D0BEE3BFF810CC6D57D760CB14C13A41156224A2398.exe	67
PID 1932 wrote to memory of 4180	1932	cmd.exe	69
PID 1932 wrote to memory of 4180	1932	cmd.exe	69

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2144-114-0x0000000000CD0000-0x0000000001A98000-memory.dmp

Filesize
13.8MB

Download
memory/2144-117-0x0000000000CD0000-0x0000000001A98000-memory.dmp

Filesize
13.8MB

Download