Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 19:08
General
- Target YouTube.Music.Desktop.App-2.0.12.Setup.exe
- Size 150.1MB
- Sample261002-xtck3sweld
- SHA256 e8962c322ce67dd04e638685cd2c21d188a2c72640d1cd65b74cc58c1912652a
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YouTube.Music.Desktop.App-2.0.12.Setup.exe"C:\Users\Admin\AppData\Local\Temp\YouTube.Music.Desktop.App-2.0.12.Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\Squirrel.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --squirrel-install 2.0.123⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\Update.exeC:\Users\Admin\AppData\Local\youtube_music_desktop_app\Update.exe --createShortcut=youtube-music-desktop-app.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exeC:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App\Crashpad" "--annotation=_productName=YouTube Music Desktop App" --annotation=_version=2.0.12 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.3.0 --initial-client-data=0x4fc,0x528,0x530,0x410,0x534,0x7ff727aa1698,0x7ff727aa16a8,0x7ff727aa16b84⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RELEASES
Update.exe
background.gif
icudtl.dat
app.asar
v8_context_snapshot.bin
youtube-music-desktop-app.exe
config.json
main.log
memory/4900-379-0x000000001D3F0000-0x000000001D5E7000-memory.dmp
memory/5908-364-0x0000000002970000-0x0000000002990000-memory.dmp
memory/6040-386-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-390-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-378-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-7-0x0000000000250000-0x0000000000426000-memory.dmp
memory/6040-380-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-382-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-384-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-99-0x0000000021E40000-0x0000000021E4E000-memory.dmp
memory/6040-98-0x0000000021E80000-0x0000000021EB8000-memory.dmp
memory/6040-392-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-388-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-394-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-396-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-398-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-400-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-402-0x000000001C780000-0x000000001C977000-memory.dmp
memory/6040-404-0x000000001C780000-0x000000001C977000-memory.dmp