Analysis
-
max time kernel
102s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2022 13:31
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
file.exe
-
Size
4.0MB
-
MD5
f9a93fa82c1194cd2545a527463945db
-
SHA1
edef9ad78265347a821d1201c0b1afc59cc1c11a
-
SHA256
426b4361fc059b4c2e98f072f989e5dd59f508785be8bd2165e87d38e9a6284d
-
SHA512
547c15386b5f714b056e227aa6abbd55fe23f874c929706eb1ad473eb9bae20f41585b96986b885cf32bdca5b62a8d0ecec3fec69f8c1cb8347ce6f37a276ff2
-
SSDEEP
98304:us5ZW5Hafm6WAmtHK52B7wnx7otb8XtCgxdth02GjRnXQCwd:OHa+qmtHKy72x7oUdth026
Malware Config
Signatures
-
YTStealer payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3484-132-0x0000000000C80000-0x0000000001A94000-memory.dmp family_ytstealer behavioral2/memory/3484-133-0x0000000000C80000-0x0000000001A94000-memory.dmp family_ytstealer behavioral2/memory/3484-137-0x0000000000C80000-0x0000000001A94000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral2/memory/3484-132-0x0000000000C80000-0x0000000001A94000-memory.dmp upx behavioral2/memory/3484-133-0x0000000000C80000-0x0000000001A94000-memory.dmp upx behavioral2/memory/3484-137-0x0000000000C80000-0x0000000001A94000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3776 powershell.exe 3776 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3776 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
file.exedescription pid process target process PID 3484 wrote to memory of 3776 3484 file.exe powershell.exe PID 3484 wrote to memory of 3776 3484 file.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776