Analysis
- user interaction
yes - max time kernel
56s - max time network
68s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 19:08
General
- Target YouTube.Music.Desktop.App-2.0.12.Setup.exe
- Size 150.1MB
- Sample261002-xtck3sweld
- SHA256 e8962c322ce67dd04e638685cd2c21d188a2c72640d1cd65b74cc58c1912652a
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 16 IoCs
- Loads dropped DLL 7 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YouTube.Music.Desktop.App-2.0.12.Setup.exe"C:\Users\Admin\AppData\Local\Temp\YouTube.Music.Desktop.App-2.0.12.Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\Squirrel.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --squirrel-install 2.0.123⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\Update.exeC:\Users\Admin\AppData\Local\youtube_music_desktop_app\Update.exe --createShortcut=youtube-music-desktop-app.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exeC:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App\Crashpad" "--annotation=_productName=YouTube Music Desktop App" --annotation=_version=2.0.12 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.3.0 --initial-client-data=0x530,0x534,0x538,0x43c,0x53c,0x7ff6d81b1698,0x7ff6d81b16a8,0x7ff6d81b16b84⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exeC:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App\Crashpad" "--annotation=_productName=YouTube Music Desktop App" --annotation=_version=2.0.12 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.3.0 --initial-client-data=0x4cc,0x4d0,0x4d4,0x43c,0x4d8,0x7ff6d81b1698,0x7ff6d81b16a8,0x7ff6d81b16b84⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\youtube-music-desktop-app.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exeC:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App\Crashpad" "--annotation=_productName=YouTube Music Desktop App" --annotation=_version=2.0.12 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.3.0 --initial-client-data=0x4a8,0x4cc,0x4d4,0x43c,0x4d8,0x7ff6d81b1698,0x7ff6d81b16a8,0x7ff6d81b16b83⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2064,i,4311867587541512087,15874987162287054852,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2072,i,357570234772820251,11214942736000077442,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2052 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" --enable-sandbox --field-trial-handle=2064,i,4311867587541512087,15874987162287054852,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2072,i,357570234772820251,11214942736000077442,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2100 /prefetch:113⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" --enable-sandbox --app-user-model-id=com.squirrel.youtube_music_desktop_app.youtube-music-desktop-app --app-path="C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2064,i,4311867587541512087,15874987162287054852,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2072,i,357570234772820251,11214942736000077442,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2092 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\Update.exeC:\Users\Admin\AppData\Local\youtube_music_desktop_app\Update.exe --checkForUpdate https://update.electronjs.org/ytmdesktop/ytmdesktop/win32-x64/2.0.123⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" --enable-sandbox --app-user-model-id=com.squirrel.youtube_music_desktop_app.youtube-music-desktop-app --app-path="C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2064,i,4311867587541512087,15874987162287054852,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2072,i,357570234772820251,11214942736000077442,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3884 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe"C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\youtube-music-desktop-app.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\YouTube Music Desktop App" --enable-sandbox --app-user-model-id=com.squirrel.youtube_music_desktop_app.youtube-music-desktop-app --app-path="C:\Users\Admin\AppData\Local\youtube_music_desktop_app\app-2.0.12\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2064,i,4311867587541512087,15874987162287054852,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2072,i,357570234772820251,11214942736000077442,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4212 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RELEASES
Update.exe
background.gif
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
en-US.pak
resources.pak
app.asar
play-button.png
play-next-button.png
play-previous-button.png
ytmd.png
v8_context_snapshot.bin
vk_swiftshader.dll
app.ico
youtube-music-desktop-app.exe
default.exc
index
settings.dat
MANIFEST-000001
f_000009
f_00000a
f_00000b
f_00000c
data_0
data_1
data_2
data_3
CURRENT
Network Persistent State
Preferences8ca5c79f-8815-4e79-a125-11979b4ab024.tmp
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
config.json
config.json
config.json.tmp-096817678541cf18
config.json.tmp-09681768074a19e0
config.json.tmp-09681768516ebc9c
electron-log-preload.js
main.log
main.log
main.log
main.log
main.log
memory/3176-107-0x00000000213E0000-0x000000002141E000-memory.dmp
memory/3176-108-0x00000000213B0000-0x00000000213BE000-memory.dmp
memory/3176-9-0x0000000000370000-0x0000000000546000-memory.dmp
memory/5332-492-0x0000000002E50000-0x0000000002E70000-memory.dmp
memory/5584-1078-0x00007FFAC9B00000-0x00007FFAC9B01000-memory.dmp
memory/5584-1077-0x00007FFACA720000-0x00007FFACA721000-memory.dmp
memory/5984-1119-0x000000001C4B0000-0x000000001C9D8000-memory.dmp