Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 01:58
Behavioral task
behavioral1
Sample
6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe
Resource
win7-20220812-en
6 signatures
300 seconds
General
-
Target
6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe
-
Size
4.0MB
-
MD5
513bf71bf90ad5d2dcb89a45f8fb1751
-
SHA1
2fe88ed7c6d32008a1377cdc6391a41077155d4c
-
SHA256
6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e
-
SHA512
5035d554b60e85d1ea43f0b21dddceadfcb78927a5ab6872aad2ebb7bf2bb0c90f234fb23209f3575f331fe9cd8af6d69cb0b3ce68132d2b10ff94f6c1ec51fb
-
SSDEEP
98304:GKxJd9dqshZXEYIRpYzHvQorgjOIY/Gr79YX6fArkS:GKxJdC9lQzRg6IMG79y
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-54-0x0000000000010000-0x0000000000DE8000-memory.dmp family_ytstealer behavioral1/memory/1644-57-0x0000000000010000-0x0000000000DE8000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral1/memory/1644-54-0x0000000000010000-0x0000000000DE8000-memory.dmp upx behavioral1/memory/1644-57-0x0000000000010000-0x0000000000DE8000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exepid process 1644 6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe 1644 6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.execmd.exedescription pid process target process PID 1644 wrote to memory of 1784 1644 6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe cmd.exe PID 1644 wrote to memory of 1784 1644 6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe cmd.exe PID 1644 wrote to memory of 1784 1644 6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe cmd.exe PID 1784 wrote to memory of 584 1784 cmd.exe choice.exe PID 1784 wrote to memory of 584 1784 cmd.exe choice.exe PID 1784 wrote to memory of 584 1784 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe"C:\Users\Admin\AppData\Local\Temp\6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\6db5eb3d1d261624b6d27741641dea379653b3a3439db34858d83447eb88033e.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵PID:584