Analysis

  • max time kernel
    50s
  • max time network
    177s
  • platform
    windows10-1703_x64
  • resource
    win10-20220718-en
  • resource tags

    arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-08-2022 06:56

General

  • Target

    21430CFFB7045CDBECEE6E57E94E3146776F0F5F366975B151A780EA6D6BF3A3.exe

  • Size

    4.0MB

  • MD5

    7986a261ce0af84ff5eebeb527a4f2e3

  • SHA1

    3a5e6906fe63867bd538d4eebe6a9e358d0c2bdc

  • SHA256

    21430cffb7045cdbecee6e57e94e3146776f0f5f366975b151a780ea6d6bf3a3

  • SHA512

    2261f064746c6a7cc0214a9d850cc6538ad6517bffbe242c4cbe4d379f291165e090e123f6e8a02da28f0adb44b6f072e6ab9052f105085cbbf2eac2c87c30f1

Malware Config

Signatures

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

  • YTStealer payload 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21430CFFB7045CDBECEE6E57E94E3146776F0F5F366975B151A780EA6D6BF3A3.exe
    "C:\Users\Admin\AppData\Local\Temp\21430CFFB7045CDBECEE6E57E94E3146776F0F5F366975B151A780EA6D6BF3A3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "" "Get-WmiObject Win32_PortConnector"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2388

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2080-117-0x00000000009F0000-0x0000000001802000-memory.dmp

    Filesize

    14.1MB

  • memory/2080-118-0x00000000009F0000-0x0000000001802000-memory.dmp

    Filesize

    14.1MB

  • memory/2080-136-0x00000000009F0000-0x0000000001802000-memory.dmp

    Filesize

    14.1MB

  • memory/2388-119-0x0000000000000000-mapping.dmp

  • memory/2388-125-0x0000028320090000-0x00000283200B2000-memory.dmp

    Filesize

    136KB

  • memory/2388-128-0x00000283201C0000-0x0000028320236000-memory.dmp

    Filesize

    472KB