Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 09:15

General

  • Target

    yt-dlg.exe

  • Size

    14.4MB

  • MD5

    4b5d8f56cbc27dd92fb8e74368a12159

  • SHA1

    5eb637a58e9b00aab4d7ecf0c98b27e03da1aa20

  • SHA256

    ffb8824e319f18366c742afe2427a86fe20a74670e63d0ce6f2dee345cc842cc

  • SHA512

    c527b08ea3c1d0210acd5c847053675dee77f90ff1c158cc3d0c6b87ae2d9ef971225ca54292eeb4351c1f85d13385e45c8d35d8ffab5ebd0bed32ce91a79a9d

  • SSDEEP

    393216:eXx2aq+ZkFyKx0k3NDIz8zxfsuIp8C7AI:eXpCfj3NDIAJIk

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\yt-dlg.exe
    "C:\Users\Admin\AppData\Local\Temp\yt-dlg.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Users\Admin\AppData\Local\Temp\yt-dlg.exe
      "C:\Users\Admin\AppData\Local\Temp\yt-dlg.exe"
      2⤵
      • Loads dropped DLL
      PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-file-l1-2-0.dll

    Filesize

    20KB

    MD5

    d92e6a007fc22a1e218552ebfb65da93

    SHA1

    3c9909332e94f7b7386664a90f52730f4027a75a

    SHA256

    03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862

    SHA512

    b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

  • C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-file-l2-1-0.dll

    Filesize

    20KB

    MD5

    50abf0a7ee67f00f247bada185a7661c

    SHA1

    0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

    SHA256

    f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

    SHA512

    c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

  • C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    de5695f26a0bcb54f59a8bc3f9a4ecef

    SHA1

    99c32595f3edc2c58bdb138c3384194831e901d6

    SHA256

    e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a

    SHA512

    df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

  • C:\Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    20KB

    MD5

    cb39eea2ef9ed3674c597d5f0667b5b4

    SHA1

    c133dc6416b3346fa5b0f449d7cc6f7dbf580432

    SHA256

    1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235

    SHA512

    2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

  • C:\Users\Admin\AppData\Local\Temp\_MEI23282\python310.dll

    Filesize

    4.3MB

    MD5

    e4533934b37e688106beac6c5919281e

    SHA1

    ada39f10ef0bbdcf05822f4260e43d53367b0017

    SHA256

    2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

    SHA512

    fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

  • C:\Users\Admin\AppData\Local\Temp\_MEI23282\ucrtbase.dll

    Filesize

    1.1MB

    MD5

    3b337c2d41069b0a1e43e30f891c3813

    SHA1

    ebee2827b5cb153cbbb51c9718da1549fa80fc5c

    SHA256

    c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

    SHA512

    fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

  • \Users\Admin\AppData\Local\Temp\_MEI23282\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    20KB

    MD5

    74c264cffc09d183fcb1555b16ea7e4b

    SHA1

    0b5b08cdf6e749b48254ac811ca09ba95473d47c

    SHA256

    a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09

    SHA512

    285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1