Analysis
-
max time kernel
50s -
max time network
180s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
14-08-2022 22:17
Behavioral task
behavioral1
Sample
839f7c1eff77ede1cfb0698e4c1ac04ecd201d2fab2db25668cc711eff551458.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
300 seconds
General
-
Target
839f7c1eff77ede1cfb0698e4c1ac04ecd201d2fab2db25668cc711eff551458.exe
-
Size
4.0MB
-
MD5
90959601fac910020d86ec5a2f8d39f6
-
SHA1
3b21d9428979b79fa319839ee0225991e922a110
-
SHA256
839f7c1eff77ede1cfb0698e4c1ac04ecd201d2fab2db25668cc711eff551458
-
SHA512
f3aa6853b0c105c106a4295fa213b942fd37add8fa44a96c82a2243f163ac4c42cd210f30fe944d675568665b6172fd8c83cb4fffeaebc1e715f8bdfb13b72d8
Malware Config
Signatures
-
YTStealer payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1764-117-0x0000000001160000-0x0000000001F72000-memory.dmp family_ytstealer behavioral2/memory/1764-118-0x0000000001160000-0x0000000001F72000-memory.dmp family_ytstealer behavioral2/memory/1764-119-0x0000000001160000-0x0000000001F72000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral2/memory/1764-117-0x0000000001160000-0x0000000001F72000-memory.dmp upx behavioral2/memory/1764-118-0x0000000001160000-0x0000000001F72000-memory.dmp upx behavioral2/memory/1764-119-0x0000000001160000-0x0000000001F72000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.