ytstealer | b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03

Analysis

max time kernel
49s
max time network
178s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
15/09/2022, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe
Size 4.0MB
Sample220915-d4nljsbhc5
SHA256 b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03
MD5 813d2e61d875a47802c0f054ea6b9374
SHA1 66984763487a239efbceb9cfb72e1dcaa4907c67
SHA512 654beccaf8a7f42ef4421d11091f15bb6740553955d1bddc955a3fa3c7f66ce0aa81fdbeb3fc31ca5ec6496e89bf8c1c260479e667918370cfcdc63a1a921376
SSDEEP 98304:7PlSywYb7eYadIK5j+AqdBkGx6mk9/8RTXk9kUzb8dgOsxegEKQz69:7NXK5j+Tymk9/8RLybp2KQe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ytstealer spyware stealer upx

Malware Config

Signatures

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2932-123-0x00000000003D0000-0x0000000001198000-memory.dmp	family_ytstealer

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2932-120-0x00000000003D0000-0x0000000001198000-memory.dmp	upx
behavioral2/memory/2932-123-0x00000000003D0000-0x0000000001198000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2932	b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe
2932	b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe
2932	b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe
2932	b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3968	2932	b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe	67
PID 2932 wrote to memory of 3968	2932	b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe	67
PID 3968 wrote to memory of 4528	3968	cmd.exe	69
PID 3968 wrote to memory of 4528	3968	cmd.exe	69

C:\Users\Admin\AppData\Local\Temp\b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe
"C:\Users\Admin\AppData\Local\Temp\b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\b4d851f3f2dbd8d091936a4e6fda92659faa8a60b190e5c0bf9d9c54135e7d03.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 0
    3⤵
    PID:4528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-120-0x00000000003D0000-0x0000000001198000-memory.dmp

Download

memory/2932-123-0x00000000003D0000-0x0000000001198000-memory.dmp

Download