Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 02:05
Behavioral task
behavioral1
Sample
8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
300 seconds
General
-
Target
8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe
-
Size
4.0MB
-
MD5
a2247e2d681b29acc6fa1dc68c2ab231
-
SHA1
cd2767a3438f6e48ace39fca0583801e13618229
-
SHA256
8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f
-
SHA512
ad1868aa8019aa2d358ed101e3a02d4a0a97a1c20edacd54216af081d7bd26506c4d8b05d424c9e5cb95508d9e07ba46d1562076b3e161131f14e832262c0d5e
-
SSDEEP
98304:ideiIhWjD/6XnGDT1DFjgfYOiQzsHIxh56QG:ceibn6ODFbOiQzsoxh5
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-54-0x0000000000180000-0x0000000000F59000-memory.dmp family_ytstealer behavioral1/memory/1648-57-0x0000000000180000-0x0000000000F59000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral1/memory/1648-54-0x0000000000180000-0x0000000000F59000-memory.dmp upx behavioral1/memory/1648-57-0x0000000000180000-0x0000000000F59000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exepid process 1648 8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe 1648 8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.execmd.exedescription pid process target process PID 1648 wrote to memory of 588 1648 8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe cmd.exe PID 1648 wrote to memory of 588 1648 8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe cmd.exe PID 1648 wrote to memory of 588 1648 8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe cmd.exe PID 588 wrote to memory of 1292 588 cmd.exe choice.exe PID 588 wrote to memory of 1292 588 cmd.exe choice.exe PID 588 wrote to memory of 1292 588 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe"C:\Users\Admin\AppData\Local\Temp\8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\8216f0831a442e0f386c9f7af6e34bf516a46b373757287037e2eb91a71c143f.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵