Analysis
-
max time kernel
139s -
max time network
183s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-08-2022 01:35
Behavioral task
behavioral1
Sample
325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe
Resource
win7-20220812-en
7 signatures
300 seconds
General
-
Target
325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe
-
Size
4.0MB
-
MD5
c3a2f32f8e28de0c3da940a20c10ec6d
-
SHA1
4441343764f427468a2becf77e4e5fba3962995d
-
SHA256
325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70
-
SHA512
42682cf2becc5216bc52fadc845f8a2f6cfb753fc754a83771542dbe9a4e47b7bae6cca2a8aa93c8591315b265a66f4852e90bf041a387d99764bd80f9c5b77b
-
SSDEEP
98304:L403ZfmsuB4LWXS/sQDRpWs25JAuYHXUA5MGGaKJr04:U03ZkQf/sQFkPUueUA5R4
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4208-116-0x00000000003D0000-0x0000000001198000-memory.dmp family_ytstealer behavioral2/memory/4208-119-0x00000000003D0000-0x0000000001198000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral2/memory/4208-116-0x00000000003D0000-0x0000000001198000-memory.dmp upx behavioral2/memory/4208-119-0x00000000003D0000-0x0000000001198000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exepid process 4208 325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe 4208 325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe 4208 325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe 4208 325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.execmd.exedescription pid process target process PID 4208 wrote to memory of 2288 4208 325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe cmd.exe PID 4208 wrote to memory of 2288 4208 325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe cmd.exe PID 2288 wrote to memory of 2624 2288 cmd.exe choice.exe PID 2288 wrote to memory of 2624 2288 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe"C:\Users\Admin\AppData\Local\Temp\325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\325c1d2b676eca595aeed8a77fdc1e909b6d4d02615478cf747023fd9868ba70.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵PID:2624