Analysis

  • max time kernel
    240s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2022 22:16

General

  • Target

    2d3e9420c47dee79a05feb09067fd4ee602f5739d2b742a77385586e40c8b6cc.exe

  • Size

    4.0MB

  • MD5

    789f04871acbe502515765238fc53d64

  • SHA1

    9e2546dd0c9922cc1f11e2b9e72e89b66a74373b

  • SHA256

    2d3e9420c47dee79a05feb09067fd4ee602f5739d2b742a77385586e40c8b6cc

  • SHA512

    061ea32c791a1917bca0fadd303d930e2ca537c1339471a6e2a2b5b35c15ef7bf4e77d6e6fcb51bceb5646cffaa7f7bb6697ae4804ef8bc8300b857efacb1c18

Malware Config

Signatures

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

  • YTStealer payload 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d3e9420c47dee79a05feb09067fd4ee602f5739d2b742a77385586e40c8b6cc.exe
    "C:\Users\Admin\AppData\Local\Temp\2d3e9420c47dee79a05feb09067fd4ee602f5739d2b742a77385586e40c8b6cc.exe"
    1⤵
      PID:1960

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1960-54-0x0000000000BF0000-0x0000000001A02000-memory.dmp

      Filesize

      14.1MB

    • memory/1960-55-0x0000000000BF0000-0x0000000001A02000-memory.dmp

      Filesize

      14.1MB

    • memory/1960-56-0x0000000000BF0000-0x0000000001A02000-memory.dmp

      Filesize

      14.1MB