Analysis
-
max time kernel
164s -
max time network
176s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
12-08-2022 07:07
Behavioral task
behavioral1
Sample
99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe
Resource
win7-20220718-en
windows7-x64
6 signatures
300 seconds
General
-
Target
99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe
-
Size
4.0MB
-
MD5
38069d06debf35bab01ffab2d69876b1
-
SHA1
d475a44c97c07aa79a0a91d93985377217936479
-
SHA256
99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b
-
SHA512
b94d2791a4d5b075dedeab358af12a616b96506df85aa501bc46ce77f939bdd1617aef2023290235fa8228312b60c2ac3f8d4d96e62a3063cfe1dd38ad492686
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2644-118-0x00000000000B0000-0x0000000000E79000-memory.dmp family_ytstealer behavioral2/memory/2644-120-0x00000000000B0000-0x0000000000E79000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral2/memory/2644-118-0x00000000000B0000-0x0000000000E79000-memory.dmp upx behavioral2/memory/2644-120-0x00000000000B0000-0x0000000000E79000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exepid process 2644 99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe 2644 99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe 2644 99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe 2644 99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.execmd.exedescription pid process target process PID 2644 wrote to memory of 2224 2644 99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe cmd.exe PID 2644 wrote to memory of 2224 2644 99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe cmd.exe PID 2224 wrote to memory of 4504 2224 cmd.exe choice.exe PID 2224 wrote to memory of 4504 2224 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe"C:\Users\Admin\AppData\Local\Temp\99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\99397F1C6FF002C0E52CE8DBCFC6341D2592D8C7A12462ADB0EFC3450CFCD34B.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵PID:4504