Analysis
-
max time kernel
50s -
max time network
57s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31-08-2022 10:34
General
-
Target
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe
-
Size
4.0MB
-
MD5
b09ec6718a34a70a182f3412b89f6777
-
SHA1
e730645db18339897aeddb4f21ce662911e03444
-
SHA256
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2
-
SHA512
5d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881
-
SSDEEP
98304:GbhyCQjQZtnVQvM1ozGPpf4jhxJ6J+wVj9h6QzJwH8Kk:OkQZtVFmjFjkj9hBwH8V
Malware Config
Signatures
-
YTStealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2128-123-0x0000000000BE0000-0x00000000019B9000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral1/memory/2128-120-0x0000000000BE0000-0x00000000019B9000-memory.dmp upx behavioral1/memory/2128-123-0x0000000000BE0000-0x00000000019B9000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exepid process 2128 21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe 2128 21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe 2128 21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe 2128 21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.execmd.exedescription pid process target process PID 2128 wrote to memory of 4448 2128 21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe cmd.exe PID 2128 wrote to memory of 4448 2128 21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe cmd.exe PID 4448 wrote to memory of 4728 4448 cmd.exe choice.exe PID 4448 wrote to memory of 4728 4448 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe"C:\Users\Admin\AppData\Local\Temp\21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵