8da3f5cb51b6957627bf804edb2ae69c3633222d9a1e23583d1c6f810a81188b

Analysis

Target

Discord token grabber/TokenPuller V.3.1 (setup) - by hokyz.exe
Size

30.1MB
MD5

ba32786e2bcde7e3d648e3fb7eb9e29c
SHA1

298561178fea0eda9cdbf59f93928b74b475dea9
SHA256

0d8833793a712d4af7c832fbbb70dd171d15de09e5f472fa351294eba746baa1
SHA512

e8ec4f2ce32cc583ec2365702ffd0998e57d5212263196e96bb2e3f5b13353f483fc347671dc7c13fa8d9b3f195beec1956ed0fc1b45b87acd7efa103956f54f

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

3192 tasklist.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tasklist.exe

description pid process

Token: SeDebugPrivilege 3192 tasklist.exe

pid	process
3192	tasklist.exe

description	pid	process
Token: SeDebugPrivilege	3192	tasklist.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

TokenPuller V.3.1 (setup) - by hokyz.execmd.exe

description	pid	process	target process
PID 968 wrote to memory of 1344	968	TokenPuller V.3.1 (setup) - by hokyz.exe	cmd.exe
PID 968 wrote to memory of 1344	968	TokenPuller V.3.1 (setup) - by hokyz.exe	cmd.exe
PID 1344 wrote to memory of 3192	1344	cmd.exe	tasklist.exe
PID 1344 wrote to memory of 3192	1344	cmd.exe	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\Discord token grabber\TokenPuller V.3.1 (setup) - by hokyz.exe
"C:\Users\Admin\AppData\Local\Temp\Discord token grabber\TokenPuller V.3.1 (setup) - by hokyz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
- Suspicious use of WriteProcessMemory
PID:1344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

memory/968-130-0x0000036BD8480000-0x0000036BD8481000-memory.dmp

Filesize
4KB

Download
memory/1344-131-0x0000000000000000-mapping.dmp

Download
memory/3192-132-0x0000000000000000-mapping.dmp

Download