Analysis
-
max time kernel
53s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-08-2022 01:13
Behavioral task
behavioral1
Sample
02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
300 seconds
General
-
Target
02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe
-
Size
4.0MB
-
MD5
8b5dfbceeb3cc80ced3a6e43e6e45307
-
SHA1
cd10c62afd118ee6dbdea28df5676b18ed0b9af6
-
SHA256
02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6
-
SHA512
5c0df3e960dc75d204aef02ea006c4135d50fe9654a0d55c3c66c19047e89856323f109df9749a5b7b56ef78b7200c0882a85561513c1526322edad7436a5d3b
-
SSDEEP
98304:IzCs6IZ2k7AMUrtN3zFayq2VO6DbfK1okdAdrnypNpC:IWcYcpEtN3pa32VBDm1oLc
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2664-115-0x0000000000950000-0x0000000001729000-memory.dmp family_ytstealer behavioral2/memory/2664-118-0x0000000000950000-0x0000000001729000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral2/memory/2664-115-0x0000000000950000-0x0000000001729000-memory.dmp upx behavioral2/memory/2664-118-0x0000000000950000-0x0000000001729000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exepid process 2664 02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe 2664 02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe 2664 02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe 2664 02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.execmd.exedescription pid process target process PID 2664 wrote to memory of 2308 2664 02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe cmd.exe PID 2664 wrote to memory of 2308 2664 02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe cmd.exe PID 2308 wrote to memory of 4652 2308 cmd.exe choice.exe PID 2308 wrote to memory of 4652 2308 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe"C:\Users\Admin\AppData\Local\Temp\02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\02fbc16f240023c0ad872ec1c28ca213d5fdc8bf1d8731e2fbee5f88da56bfa6.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵