7ab505da56855344404834de64efa3c3bf396cb051f09f849c5ec24c1dacb0a5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/ytb.exe
Size 2.2MB
Sample260913-amvrraycme
SHA256 7ab505da56855344404834de64efa3c3bf396cb051f09f849c5ec24c1dacb0a5
MD5 f0745c1e12ff5179d8452d162fa5369a
SHA1 84ffda6e09fa86dd78d886854f24c1fbef04b257
SHA512 0e6e973993da04451565347e6c4fddf7e677aceb136da3a5c11230ceab082829671b5f711ea6e1447f30da368207b95cdaa974251d9cf56494c007ba1cad10a1
SSDEEP 49152:sLDL9QwXSoBJQX19YDSWWAoL5QnqAHYcFPw3tdq:sLUoUKIbMqoYcC9dq
TLSH
T1B1A533D38587F5CFE6E142B21C35A473806CAF8F1641406F9763BCEDAA7A487E047299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Control Panel\International\Geo\Nation	ytb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Control Panel\International\Geo\Nation	ytb_setup.exe

Executes dropped EXE 1 IoCs

pid	Process
2616	ytb_setup.exe

Loads dropped DLL 42 IoCs

pid	Process
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
5652	ytb.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe
2616	ytb_setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytb_setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe
5652	ytb.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 2616	5652	ytb.exe	88

C:\Users\Admin\AppData\Local\Temp\$TEMP\ytb.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\ytb.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Users\Admin\AppData\Local\Temp\nsh6ECE.tmp\ytb_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\nsh6ECE.tmp\ytb_setup.exe" /ybsini=C:\Users\Admin\AppData\Local\Temp\nsh6ECE.tmp\BOOTST~1.INI
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh6ECE.tmp\System.dll
Size 9KB
SHA256 fd58286ab8abf3400912809a78d679f75b8054878e804a8e9767b2379f184f71
MD5 9c32a7501c959b4aed7fd64313137ecc
SHA1 f59b561fe96bcc3ce3967ebb8811d8a98a34f134
SHA512 2db04fdb6c77cfe09db8a4d4b33ab20561544eb8344e15bec521e62a49225389ae612feef127a8b1af2858d2e0517d0bbb71510482a19466be309f7bffe3bc28
SSDEEP 96:rDhuJxuSaQJOhgO0nOQ3MnU+RyWg1sMI45CS5bGCs5/LxLo5R4uaGZef4cX1l8Sy:rVS+6dMU+wWg1sMI4/5aCs51gHDFaeN
TLSH
T158122A251F6081F3C660C1B88C5621623F3E325856B14FA7EFA78C897E646C67E39362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.ini

Path C:\Users\Admin\AppData\Local\Temp\nsh6ECE.tmp\bootstrap.ini
Size 480B
SHA256 edd24217e36177e37ed0b5aa8bac24e60ac9058ae9afa971fcdf69432b0b6276
MD5 3cd6cb5c2494ae7d2de0f1ca07383c85
SHA1 172bd7db3c551fb896c7ab25a978020f8cbf62cb
SHA512 e56ee7b3d6b298e324d758f90410c495229b1c135312e2ab2aac8ed6a690c70e08bb5f7a536d17f9b10ef58304cfb90481670a9cea67a19cb3875daca72d8857
TLSH
T183F01553BAE05004F7B72EA1FAA650F46BB9B861690D910CC0C0410E0CE2E148A23BE3
MD5 SHA1 SHA512 TLSH

Submit Download

nsisProcMgr_U.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh6ECE.tmp\nsisProcMgr_U.dll
Size 52KB
SHA256 657fb9d2407e65eb4f8ea74ec97cbcfd2c85c2e06422836ddbf3688b3c4da0fe
MD5 c4d19cd1dc5af2e7d045605f3f27b565
SHA1 984b531409b257554c2b3077e3ff0768436dee70
SHA512 2546410cf269a58f1a5c0b8d61b568a1c529e3ea9d2a24b0be568a885b7045e8e2ba68b4fe1310473b48a68a697f28d6d71398efdd91280c0081cfbac5d75d3a
SSDEEP 768:VXj62WD6/RfbNmRAs/EC1yXSpi00VtN7Y:NFWEhWECcX1jtN
TLSH
T1493308097C438073F146493892C596C55FFE6D033AF370AFEFA602495AE12D861BAAF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytb_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\nsh6ECE.tmp\ytb_setup.exe
Size 1.9MB
SHA256 d5832cf2b429e366e9642fef77839606697f47dbbb98d8f201022e2cfabaab45
MD5 1db10164064e0b881f984c37b64e1529
SHA1 6f72e0e49098f2083d1dea202a6d77350edd29d0
SHA512 9ea92d9f6e991fc281d41162409451dca4148b7b13883069997503c48596e9ce5986038fe156125d5c0800fb3641a24fe19ad1cfa6c53bba76d21ff66015ca0c
SSDEEP 49152:XmqjbQpRwQEr6OjTxA5PXnT/XAcgG4mBPdeRT/oj:XmkspRwQ466TxEXnDAGJmRboj
TLSH
T1C39533E39B579543ECA68B31A067863587476E4F6BF0633BA353B9CEBA30103D905721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu743D.tmp\InstallOptions.dll
Size 15KB
SHA256 a0bbb60b8651fb0f10384f38c33fd16600996b6c2c041480326d3cf5d0f54ec4
MD5 049a962ab217f6e55e5e4209a9d4a1f0
SHA1 f24156bb5c6540be11ffbe0cb9d739ad9ad1a00f
SHA512 f9f94c4d429ba213c0cccf447b727813ef5b2d2c6f1dda5d4620eadbb3ea7d8415b0a9fc900821f83cc8f69501b8b568c948eeabafcb455f8fab1de181aaa3a8
SSDEEP 384:3LbZ+21yxu6kGxPcSkfWpATCziU8OvNV:7bj1yomESkQNIi
TLSH
T15C624C2137D51073DEA126B26AFB63179FA2B61124D24C0B8E736EC71D2D681DE34763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

privacy.unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu743D.tmp\privacy.unicode.ini
Size 2KB
SHA256 aebca120b26bc07bee9d0e8c365c667c3dd84d44089ecc2b99132a5e80ed74fb
MD5 37d515827b3fec69e9405477d90e2100
SHA1 239804a112df6b9fddc13482b1e179d8fc4210fb
SHA512 3a951f5e443ec34e1a9263c8eb525230d44e9050cca351e911ac02bda5c6802edc6a29eee413136d5b6f0ae096a9d49d55eca39ac8d6da1599e542449602eaab
TLSH
T19251BC173EB98200E4AAA24CEBF2817597393505181DC95E92F54A0E69F8B80506BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

privacy.unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu743D.tmp\privacy.unicode.ini
Size 3KB
SHA256 0a6ee7566e7e592e0bb08bae4123327d900f499bfe080752ef9bce8e5c375f7b
MD5 336003ab2cf7148f06e4933160488dfc
SHA1 032bf55243c2b5c122fdc1441869f335467bcea2
SHA512 9bb4fa4959083a69e35c065cb6ffc91187c519cb5baf5e75d5cf65eaa50d340b6096349fb22ed929ed864694d38a43b6ba9e68a17bc34d6fd4d9a3b821f70aad
TLSH
T1D151F2173DBA8615E4BBF28DEBF28579D7383105181CC90E91E50A0E58F9E80542BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

welcome.unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu743D.tmp\welcome.unicode.ini
Size 2KB
SHA256 c2e1fa972dc7166fadd17302280567884012d8b37a67a658b303d2c3a6fc8c22
MD5 4a3cbf11ab5887d266fe0e0599d9c9b9
SHA1 4fa37a6e84dd5e4626bcfa5c73d789ec10e0487f
SHA512 3cf2ca6a3fe7cc158fa3556160aff6344b313e343b6ed0794946108b475af7f0127c9c9d74c61af2cac0b96e4ff1930a7183868849ec2ab2ab54f6702be852f4
TLSH
T1055172533EF94120F2BB7658FBF6407197397846A83DC94E81E10A0E48F5A81446BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

welcome.unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu743D.tmp\welcome.unicode.ini
Size 2KB
SHA256 d1f9018626e38efb5bdb4a232727e2b15e910e481ddcade66d4a9e1773ec80b5
MD5 66812c5df2ae1c8ea574ea6fe4440037
SHA1 79f48008e932e7117c7e7c56c5b91e96044b08e2
SHA512 8bc1415f47d710057d3eb648b3a7cf30166753e642a2e8edc4378dc34ac20c2a6d28099e08f1027102b8129abcdbc3841634a430e6214e9ceb5f38de58a7667b
TLSH
T1D951B1133EF90124F1BBB649FBF5407997397446A83CC90E91E10A4E48F2A814967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

welcome.unicode.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu743D.tmp\welcome.unicode.ini
Size 2KB
SHA256 597bd25b1e67ed77f08240e524d9c3cd1f5ef766cef2b9cc0d94842adabcdc0c
MD5 2513191ddd5cc070b34e8c234a7b6e7a
SHA1 f78b71bb1fef1e52ffb01414307efa030426690a
SHA512 42dd4ebbf0fe47e00cc1b78f68bed9730635c0b694f1cce5b516be080b4ed7a87674ba28c741845c8b3c582c748095c50e7fec05c94e1f92548b530d14bca296
TLSH
T10651B3133EF90124F1BBB649FBF5407997397446A43CC90E91E10A4E48F2A814967BEF
MD5 SHA1 SHA512 TLSH

Submit Download