Analysis
-
max time kernel
52s -
max time network
176s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-08-2022 02:08
Behavioral task
behavioral1
Sample
8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe
Resource
win7-20220812-en
6 signatures
300 seconds
General
-
Target
8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe
-
Size
4.0MB
-
MD5
4e90d708b8813a0a9e44cadf67bd101e
-
SHA1
a71c7d7eedc0f180b61f5781b4f8ca4e93ddbcb9
-
SHA256
8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a
-
SHA512
0475f14da1f73d98d5767691b59f95e18df5a7c40a388ed17e7ee8c6b58992bac1e6d5c3f8341c335462b3858f7a1d6b614f0471ae67a412306bb5352627ee0e
-
SSDEEP
98304:PvqIomm7x5vc2WIskx5791rOCAg8lNAO:8502WIt1qfDE
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2144-120-0x00000000003E0000-0x00000000011B8000-memory.dmp family_ytstealer behavioral2/memory/2144-122-0x00000000003E0000-0x00000000011B8000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral2/memory/2144-120-0x00000000003E0000-0x00000000011B8000-memory.dmp upx behavioral2/memory/2144-122-0x00000000003E0000-0x00000000011B8000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exepid process 2144 8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe 2144 8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe 2144 8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe 2144 8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.execmd.exedescription pid process target process PID 2144 wrote to memory of 1464 2144 8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe cmd.exe PID 2144 wrote to memory of 1464 2144 8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe cmd.exe PID 1464 wrote to memory of 2972 1464 cmd.exe choice.exe PID 1464 wrote to memory of 2972 1464 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe"C:\Users\Admin\AppData\Local\Temp\8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\8b15d2bc31adb8497a725317f8af0fe7ad6eb74141aaf41e4da13bb61d1fb81a.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵