Analysis
-
max time kernel
56s -
max time network
172s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30/08/2022, 01:42
Behavioral task
behavioral1
Sample
4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe
Resource
win7-20220812-en
6 signatures
300 seconds
General
-
Target
4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe
-
Size
4.0MB
-
MD5
8fb7786eff6684cf88765737627d6a94
-
SHA1
72df50be821f033c766d1772afca09a19cd4eefc
-
SHA256
4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8
-
SHA512
c9c1673155d85251cf324eacd4f2709c41bdbce3ea1fff4de0b79b0af9733baacb78cb9eda7ddbe5165d740a89a951284fea7e03b2f0a8fcefdac5105c6958d8
-
SSDEEP
98304:9UkxF4ytGpJEFKgeLzRdYI25aVpveWFMYN7lfuJIX1dOYkyPa:9Uk7ztGpn7d525aVdFMYNxGalsY
Malware Config
Signatures
-
YTStealer payload 1 IoCs
resource yara_rule behavioral2/memory/2540-118-0x0000000000C50000-0x0000000001A19000-memory.dmp family_ytstealer -
resource yara_rule behavioral2/memory/2540-115-0x0000000000C50000-0x0000000001A19000-memory.dmp upx behavioral2/memory/2540-118-0x0000000000C50000-0x0000000001A19000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2540 4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe 2540 4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe 2540 4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe 2540 4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 4948 2540 4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe 67 PID 2540 wrote to memory of 4948 2540 4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe 67 PID 4948 wrote to memory of 4748 4948 cmd.exe 69 PID 4948 wrote to memory of 4748 4948 cmd.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe"C:\Users\Admin\AppData\Local\Temp\4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\4648b964ea9bc1413b6a365be7d665143c7f1d246bbef3233e1d3449e3db8fa8.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵PID:4748
-
-