Analysis
-
max time kernel
142s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 21:34
Behavioral task
behavioral1
Sample
yt-dlp.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
yt-dlp.exe
Resource
win10v2004-20240426-en
General
-
Target
yt-dlp.exe
-
Size
17.8MB
-
MD5
b2a5579c2e58cbd4cde5a53f35da5109
-
SHA1
ceae6c7fd4149f02df925316335754e31001880e
-
SHA256
e96f6348244306ac999501b1e8e2b096b8a57f098c3b2b9ffe64b2107039e0ae
-
SHA512
4b786138bbea8664cdec97da44d0bc6521ac17c9277bc6a08f845a1c037a3d3c19642c06dc2ffa23f4267f17222f7950ec293fc42e90ad7e9cf85521e375cac9
-
SSDEEP
393216:Bq/eQlCfpyFCEDMJ83a109XdwWAXskRdpeHZxqle1PUOuz8asctUTMd:SeQlCBQCEDOEaMtwLXTjIZxqWD6hVKc
Malware Config
Signatures
-
Loads dropped DLL 50 IoCs
Processes:
yt-dlp.exepid process 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe 4572 yt-dlp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
yt-dlp.exeyt-dlp.exedescription pid process target process PID 1832 wrote to memory of 4572 1832 yt-dlp.exe yt-dlp.exe PID 1832 wrote to memory of 4572 1832 yt-dlp.exe yt-dlp.exe PID 4572 wrote to memory of 2344 4572 yt-dlp.exe cmd.exe PID 4572 wrote to memory of 2344 4572 yt-dlp.exe cmd.exe PID 4572 wrote to memory of 2492 4572 yt-dlp.exe cmd.exe PID 4572 wrote to memory of 2492 4572 yt-dlp.exe cmd.exe PID 4572 wrote to memory of 4568 4572 yt-dlp.exe cmd.exe PID 4572 wrote to memory of 4568 4572 yt-dlp.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\yt-dlp.exe"C:\Users\Admin\AppData\Local\Temp\yt-dlp.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yt-dlp.exe"C:\Users\Admin\AppData\Local\Temp\yt-dlp.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\Cryptodome\Cipher\_raw_cbc.pydFilesize
12KB
MD56840f030df557b08363c3e96f5df3387
SHA1793a8ba0a7bdb5b7e510fc9a9dde62b795f369ae
SHA256b7160ed222d56925e5b2e247f0070d5d997701e8e239ec7f80bce21d14fa5816
SHA512edf5a4d5a3bfb82cc140ce6ce6e9df3c8ed495603dcf9c0d754f92f265f2dce6a83f244e0087309b42930d040bf55e66f34504dc1c482a274ad8262aa37d1467
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\Cryptodome\Cipher\_raw_ecb.pydFilesize
10KB
MD51c74e15ec55bd8767968024d76705efc
SHA1c590d1384d2207b3af01a46a5b4f7a2ae6bcad93
SHA2560e3ec56a1f3c86be1caa503e5b89567aa91fd3d6da5ad4e4de4098f21270d86b
SHA512e96ca56490fce7e169cc0ab803975baa8b5acb8bbab5047755ae2eeae177cd4b852c0620cd77bcfbc81ad18bb749dec65d243d1925288b628f155e8facdc3540
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\VCRUNTIME140.dllFilesize
93KB
MD54a365ffdbde27954e768358f4a4ce82e
SHA1a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA2566a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA51254e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_asyncio.pydFilesize
63KB
MD50400b1958d0f7aa0d2ad409ea12ffec7
SHA1ce1a5c61192ffe489a53f029ac0a95d4abb3d2b9
SHA2566e25aa5931f175b971dfd05aab7a24cef29edd8f4b524341c414d0577c07a200
SHA5128790f3f9c69823d55350ea63a1b8ebb3dad64942b6e6752109d2932b3bb848a5101e2a9a4645e93a476a8c4e5c8b27e15eb39b33fcc772a876b0e8ab9fd5eefa
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_brotli.cp38-win_amd64.pydFilesize
801KB
MD5cae1e7b2024ce7638dba9e95c0e8d673
SHA1efbd9a82423a0fb1112c3eecb3debf45ff0b68e8
SHA256d84c3931d20ba057b0b69ecb559c537dcf13d56912af50c333c6112bf67b71fe
SHA512680701a0d09533cb1786d31a066537143ec67a30fc79e2a0e4816e12d38e4aaa634eafc47231ab1ab05be5776fa1b56be19827a4c5c254a990da0e80ec17525d
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_bz2.pydFilesize
85KB
MD5a49c5f406456b79254eb65d015b81088
SHA1cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_cffi_backend.cp38-win_amd64.pydFilesize
177KB
MD577b5d28b725596b08d4393786d98bd27
SHA1e3f00478de1d28bc7d2e9f0b552778be3e32d43b
SHA256f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c
SHA512d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_ctypes.pydFilesize
124KB
MD5291a0a9b63bae00a4222a6df71a22023
SHA17a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_decimal.pydFilesize
262KB
MD5a2b554d61e6cf63c6e5bbafb20ae3359
SHA126e043efdaaa52e9034602cebeb564d4f9714a7f
SHA25630eea56a4d1dd78f9d65fcb6168ab189cfa8098c38aad47ee770756a056749ca
SHA5125ea99fa23e7657e9f01dc155741d5f93945a2e6c90f1494873aa7c35a8da0001815b31b387b239ef7de1695b8f416028166dd94db259d246d8dc10a37e20da97
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_elementtree.pydFilesize
175KB
MD58216378d8e15d65dbfcb7ba68bbd923a
SHA191e3a9a89c236d7018854f7f163bc291a46397c2
SHA25600d68d3879ab410601e7e8fb2348d4995cec2ee78b3a07ea59520d35f9953bb4
SHA5122610324ae9510b68745c5500e7a99366e5eaa0a935a43eb951dd78789772ded6cfe9581b6108540a5cac9f848173c9375ee6fd91e40cb6a982114905f7cfd578
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_hashlib.pydFilesize
46KB
MD55e5af52f42eaf007e3ac73fd2211f048
SHA11a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_lzma.pydFilesize
159KB
MD5cf9fd17b1706f3044a8f74f6d398d5f1
SHA1c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA2569209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA5125fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_overlapped.pydFilesize
45KB
MD57d5bb2a3e4fbceaddfeef929a21e610c
SHA1942b69e716ee522ef01bde792434c638e3d5497a
SHA2565f92c163b9fe6abb0f8b106a972f6a86f84271b2e32c67f95737387c85719837
SHA5128c44f1683fdea0d8121ff2fe36f2582313980ef20ee1985af7ff36acb022acbb7617e85d2dd3b8e75715444dc0cfc4487c81b43d0222bd832aac867875afbe30
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_queue.pydFilesize
28KB
MD5dd146e2fa08302496b15118bf47703cf
SHA1d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA25667e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA5125b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_socket.pydFilesize
78KB
MD54827652de133c83fa1cae839b361856c
SHA1182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA25687832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA5128d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_sqlite3.pydFilesize
87KB
MD5434ac2f2f82d15d9a3cb57b0145e1254
SHA135327a6ac08d8954f10b1f70c0fbc3077c768504
SHA2569ae23d679a929d47b252ce14c9b2763a2913bbf17b0f52a8fd4b47aba0def0a2
SHA512e515253cbc5f7c8d2bfde5047feadfa413f637918be31053d85c89fe74aadee5f815e7a17f97ab66eceaf73170c0bf13a26f4e1a1d94b149774d4c0603a553d5
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\_ssl.pydFilesize
152KB
MD5d4dfd8c2894670e9f8d6302c09997300
SHA1c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA2560a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
SHA5121422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\base_library.zipFilesize
1008KB
MD5d7e4a82455bfe8213301ed14ff940f6e
SHA16544f0e2835700aa0973d62a34211814efad0e0c
SHA25699181827fff39cfa3e9c9f9bc26ea9259574759243998c4efc650cf561f8219e
SHA512209cce3372a9fc47de60e173aa0a0e174705710f133a5e69f5b5ec156f9ecf5d8afc0eb87ff41f9ebc9caa56ff9f4c0068fba13332e9cc0ed915638c29ac0f22
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\certifi\cacert.pemFilesize
285KB
MD5d3e74c9d33719c8ab162baa4ae743b27
SHA1ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b
SHA2567a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92
SHA512e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\charset_normalizer\md.cp38-win_amd64.pydFilesize
10KB
MD538105df780eddd734027328e0dca0ca3
SHA145f1d9e3472478f8e1ba86675f5c81c00b183bea
SHA2569512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb
SHA512ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\charset_normalizer\md__mypyc.cp38-win_amd64.pydFilesize
116KB
MD5073f09e1edf5ec4173ce2de1121b9dd1
SHA16cdb2559a1b706446cdd993e6fd680095e119b2e
SHA2567412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c
SHA51270a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\curl_cffi.libs\libcurl-cbb416caa1dd01638554eab3f38d682d.dllFilesize
4.4MB
MD5f2636d91d67310828c8b82d6b506a6fa
SHA17a4cf07ccc57c83dac492513ba67691422abe3f3
SHA2560631dab200e19da6cccf741d5a5cd57c2f0a1648f68e8c06157ac3b0df68ac44
SHA51246a7f851d811bf46a2452ed71785d00ff9d9e7f35c91bb4155a17da83b41c2c7356206cba75a72f17c4bce5e951a3442132c788efdd3d027ec45737315c83beb
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\curl_cffi\_wrapper.pydFilesize
24KB
MD5ca0e17dc228e92614eb74bc417adf64e
SHA1fbda1123a2052a7dc914ab2d6964bcf7932c90e8
SHA2569e0a0fe5dd25c0812dd1ddd5973a0e3a2e0fa3c2d7bfab2b8088b9c34d505b46
SHA51252716accd6df72f9e90c2e5c9273232f2f95e9970fe22d9c350350e3befd1495473eacf7a12b2e79c36dc44313bbb5f59b499725f40709a56efab0921e069d94
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\libcrypto-1_1.dllFilesize
3.2MB
MD589511df61678befa2f62f5025c8c8448
SHA1df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA5129af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\libffi-7.dllFilesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\libssl-1_1.dllFilesize
674KB
MD550bcfb04328fec1a22c31c0e39286470
SHA13a1b78faf34125c7b8d684419fa715c367db3daa
SHA256fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
SHA512370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\pyexpat.pydFilesize
187KB
MD52ae23047648257afa90d0ca96811979f
SHA10833cf7ccae477faa4656c74d593d0f59844cadd
SHA2565caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
SHA51213052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\python3.DLLFilesize
58KB
MD5c9f0b55fce50c904dff9276014cef6d8
SHA19f9ae27df619b695827a5af29414b592fc584e43
SHA256074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
SHA5128dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\python38.dllFilesize
4.0MB
MD526ba25d468a778d37f1a24f4514d9814
SHA1b64fe169690557656ede3ae50d3c5a197fea6013
SHA2562f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA51280471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\select.pydFilesize
27KB
MD5e21cff76db11c1066fd96af86332b640
SHA1e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\sqlite3.dllFilesize
1.4MB
MD5905715cf7c13fa864a2bec006e8fcea5
SHA16a942efbf56e4e1d432dc27da1eb51a12890018e
SHA25653aa551e62267b887017a95fe14a610c2bb3b53c4be62ddc4dc3548df3720a68
SHA5121bc168577ac6b13d856c80b51e384ca10121b1783e11f725b0c788fa12dbc5e6ce21f989f7d4f0b4f3d0386900fd92c3e45b4fb8f6c1b4b16c154cbdecb67449
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\ucrtbase.dllFilesize
987KB
MD5637c17ad8bccc838b0cf83ffb8e2c7fd
SHA1b2dd2890668e589badb2ba61a27c1da503d73c39
SHA256be7368df484688493fb49fb0c4ad641485070190db62a2c071c9c50612e43fed
SHA512f6b727c319ca2e85a9b5c5e0b9d8b9023f0cf4193fab983cfa26060923374c6abd6d11db1da2e524a8b04622a4e13beb4c48dc23f98886d4abb33eb09f3a0776
-
C:\Users\Admin\AppData\Local\Temp\_MEI18322\unicodedata.pydFilesize
1.0MB
MD5601aee84e12b87ca66826dfc7ca57231
SHA13a7812433ca7d443d4494446a9ced24b6774ceca
SHA256d8091e62c74e1b2b648086f778c3c41ce01f09661a75ea207d3fea2cf26a8762
SHA5127c2d64623c6cfd66d6729f59909c90aa944e810ff6514c58b2b3142ee90e8660b7ddf7fa187389dd333e47efe8b19e935dd4e9119c15375b69b4880d043877d7
-
memory/1832-195-0x00007FF7E7990000-0x00007FF7E79D0000-memory.dmpFilesize
256KB
-
memory/4572-196-0x00007FF7E7990000-0x00007FF7E79D0000-memory.dmpFilesize
256KB
-
memory/4572-197-0x00007FF8FEF60000-0x00007FF8FF3C5000-memory.dmpFilesize
4.4MB