ytstealer | ad0919f0e2f934ee8fea66d5dce0db81768d28675270e8b0fc3568b1bb2b4f44

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
27/07/2022, 06:34

Target

AD0919F0E2F934EE8FEA66D5DCE0DB81768D28675270E8B0FC3568B1BB2B4F44.exe
Size

4.0MB
MD5

e8a93ad4a9f75f22d7dc4f149a8ffbab
SHA1

84b49eeea55c2044147ba2e052d07fa71908b454
SHA256

ad0919f0e2f934ee8fea66d5dce0db81768d28675270e8b0fc3568b1bb2b4f44
SHA512

563ad465c969d2484ced0e9262dacc5feb5b55f6784caf9e55d343690c5ca7b27b94fd06d680096f64a9c24be994b3d41519cef3e75846ca675e5114ef287b91

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/1172-54-0x00000000008F0000-0x00000000016C8000-memory.dmp	family_ytstealer
behavioral1/memory/1172-57-0x00000000008F0000-0x00000000016C8000-memory.dmp	family_ytstealer

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1172-54-0x00000000008F0000-0x00000000016C8000-memory.dmp	upx
behavioral1/memory/1172-57-0x00000000008F0000-0x00000000016C8000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1172	AD0919F0E2F934EE8FEA66D5DCE0DB81768D28675270E8B0FC3568B1BB2B4F44.exe
1172	AD0919F0E2F934EE8FEA66D5DCE0DB81768D28675270E8B0FC3568B1BB2B4F44.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 520	1172	AD0919F0E2F934EE8FEA66D5DCE0DB81768D28675270E8B0FC3568B1BB2B4F44.exe	28
PID 1172 wrote to memory of 520	1172	AD0919F0E2F934EE8FEA66D5DCE0DB81768D28675270E8B0FC3568B1BB2B4F44.exe	28
PID 1172 wrote to memory of 520	1172	AD0919F0E2F934EE8FEA66D5DCE0DB81768D28675270E8B0FC3568B1BB2B4F44.exe	28
PID 520 wrote to memory of 1664	520	cmd.exe	30
PID 520 wrote to memory of 1664	520	cmd.exe	30
PID 520 wrote to memory of 1664	520	cmd.exe	30

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1172-54-0x00000000008F0000-0x00000000016C8000-memory.dmp

Filesize
13.8MB

Download
memory/1172-57-0x00000000008F0000-0x00000000016C8000-memory.dmp

Filesize
13.8MB

Download