Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
YoutubePlaylistDownloader.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
YoutubePlaylistDownloader.exe
Resource
win10v2004-20240611-en
General
-
Target
YoutubePlaylistDownloader.exe
-
Size
33.9MB
-
MD5
6cffc5f33542dcbe4c5e23a68155e856
-
SHA1
327dbe3a858de848624805e8549b2e32ca63e6a2
-
SHA256
49a3a54c97102079abe75283018ae2fbcb67525e9e82e154eb2eb47a7e69ab71
-
SHA512
74ccea5a8f0e3573ba091e06b4f8780f18702722ce0b30ad89b7581ff0132a984ff74411273c660a0b2597a27c6952e86676d304c7b7650b880c973e49be09af
-
SSDEEP
786432:c1IMd/U4lUbFFV9xhiLMyAr5Wo8z9CYY57DCuZO:RG/UIybD3+MyAoo8z93Y5Q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2168 YoutubePlaylistDownloader.tmp -
Loads dropped DLL 1 IoCs
pid Process 616 YoutubePlaylistDownloader.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2168 YoutubePlaylistDownloader.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 616 wrote to memory of 2168 616 YoutubePlaylistDownloader.exe 28 PID 616 wrote to memory of 2168 616 YoutubePlaylistDownloader.exe 28 PID 616 wrote to memory of 2168 616 YoutubePlaylistDownloader.exe 28 PID 616 wrote to memory of 2168 616 YoutubePlaylistDownloader.exe 28 PID 616 wrote to memory of 2168 616 YoutubePlaylistDownloader.exe 28 PID 616 wrote to memory of 2168 616 YoutubePlaylistDownloader.exe 28 PID 616 wrote to memory of 2168 616 YoutubePlaylistDownloader.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\YoutubePlaylistDownloader.exe"C:\Users\Admin\AppData\Local\Temp\YoutubePlaylistDownloader.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\is-RMEMA.tmp\YoutubePlaylistDownloader.tmp"C:\Users\Admin\AppData\Local\Temp\is-RMEMA.tmp\YoutubePlaylistDownloader.tmp" /SL5="$30146,34675314,1146880,C:\Users\Admin\AppData\Local\Temp\YoutubePlaylistDownloader.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2168
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD522d59de01f6992d864847f174e8f6f66
SHA1033e058dfe3b2620b6093f9b9036d7e29956ec55
SHA2560e45b66753d93419cb1701c5be8fae5cc5878abce68af6465ae4430a8e7d26a1
SHA512c232a24e9bae9cb17ab18a6eed4a5e70527d2ca6d70d4d2f36d39e29cdbc0965fb881cd7635b22a4cad5d0e099cbaa0e27c42872c4183bc7ed7ec62988358beb