Analysis

  • max time kernel
    102s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-08-2022 13:31

General

  • Target

    file.exe

  • Size

    4.0MB

  • MD5

    f9a93fa82c1194cd2545a527463945db

  • SHA1

    edef9ad78265347a821d1201c0b1afc59cc1c11a

  • SHA256

    426b4361fc059b4c2e98f072f989e5dd59f508785be8bd2165e87d38e9a6284d

  • SHA512

    547c15386b5f714b056e227aa6abbd55fe23f874c929706eb1ad473eb9bae20f41585b96986b885cf32bdca5b62a8d0ecec3fec69f8c1cb8347ce6f37a276ff2

  • SSDEEP

    98304:us5ZW5Hafm6WAmtHK52B7wnx7otb8XtCgxdth02GjRnXQCwd:OHa+qmtHKy72x7oUdth026

Malware Config

Signatures

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

  • YTStealer payload 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "" "Get-WmiObject Win32_PortConnector"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3484-132-0x0000000000C80000-0x0000000001A94000-memory.dmp

    Filesize

    14.1MB

  • memory/3484-133-0x0000000000C80000-0x0000000001A94000-memory.dmp

    Filesize

    14.1MB

  • memory/3484-137-0x0000000000C80000-0x0000000001A94000-memory.dmp

    Filesize

    14.1MB

  • memory/3776-134-0x0000000000000000-mapping.dmp

  • memory/3776-135-0x000002A2DCAA0000-0x000002A2DCAC2000-memory.dmp

    Filesize

    136KB

  • memory/3776-136-0x00007FFF1A7B0000-0x00007FFF1B271000-memory.dmp

    Filesize

    10.8MB