Analysis
-
max time kernel
57s -
max time network
172s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
30/08/2022, 01:59
General
-
Target
6f77aa386dcd9d24e4cb6ae1f10f779ad105ca6d74405f336b7c8be06742aabc.exe
-
Size
4.0MB
-
MD5
3c80bb1573592cc5d855e372155009b7
-
SHA1
c4d9b4f499dbe5ac3d4f4242b01af8bdac01e2e5
-
SHA256
6f77aa386dcd9d24e4cb6ae1f10f779ad105ca6d74405f336b7c8be06742aabc
-
SHA512
2964a206bef693e78bdd79b9b6e07a9056ab8caeeb76f2b93e4f1fb977d580f048749b29e4fcce8492f7dd028c23af19bc71ffaee70f52fa616e4754ec94075a
-
SSDEEP
98304:we+CD9I4tr434FJHN9QYv9P3p2Lss7hKOUMivH7K5ilVlI16o6lC9Tck:we+A9Igrmkp1P3pNoKOumoOvNTc
Score
10/10
Malware Config
Signatures
-
YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
-
YTStealer payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f77aa386dcd9d24e4cb6ae1f10f779ad105ca6d74405f336b7c8be06742aabc.exe"C:\Users\Admin\AppData\Local\Temp\6f77aa386dcd9d24e4cb6ae1f10f779ad105ca6d74405f336b7c8be06742aabc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\6f77aa386dcd9d24e4cb6ae1f10f779ad105ca6d74405f336b7c8be06742aabc.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.8MB
-
Filesize
13.8MB