Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-09-2022 03:26
Behavioral task
behavioral1
Sample
30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
300 seconds
General
-
Target
30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe
-
Size
4.0MB
-
MD5
c5ca08bcb25c45ea0f92839b22e37b15
-
SHA1
4202c1332aae996f4efa560315dd75588d425e2e
-
SHA256
30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384
-
SHA512
081d63dfdab6f45fb91a4851ee81ed55f0368d50c5b1879864d55cc3239c7fa8afe11f10fc5932ebe25b8c19c6d385c03806a93129264c8a193df0f41d97d654
-
SSDEEP
98304:Oj3R/ePCvhtmAuXSzxxm6v5rzRPwfIzIx4l2YPmZjV1:OrRDrRgSVc6Br9II8x4QkmH1
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1488-54-0x0000000000320000-0x00000000010E9000-memory.dmp family_ytstealer behavioral1/memory/1488-57-0x0000000000320000-0x00000000010E9000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral1/memory/1488-54-0x0000000000320000-0x00000000010E9000-memory.dmp upx behavioral1/memory/1488-57-0x0000000000320000-0x00000000010E9000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exepid process 1488 30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe 1488 30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.execmd.exedescription pid process target process PID 1488 wrote to memory of 1924 1488 30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe cmd.exe PID 1488 wrote to memory of 1924 1488 30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe cmd.exe PID 1488 wrote to memory of 1924 1488 30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe cmd.exe PID 1924 wrote to memory of 636 1924 cmd.exe choice.exe PID 1924 wrote to memory of 636 1924 cmd.exe choice.exe PID 1924 wrote to memory of 636 1924 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe"C:\Users\Admin\AppData\Local\Temp\30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\30e5d30cfc17f5c85ff99abce4c5c3e3b026fd01ddfaef8dc8dfb02b9c9d8384.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵PID:636