Analysis

  • max time kernel
    60s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2023 11:26

General

  • Target

    discord_token_grabber.pyc

  • Size

    17KB

  • MD5

    e523026b612006e580e96bd9e2a8882c

  • SHA1

    03b9938701f7eff11a0c3632ed805e8188598c88

  • SHA256

    8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77

  • SHA512

    a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853

  • SSDEEP

    384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    07f0b2dffc6c65f21d0e76147ee1a232

    SHA1

    a217262115e7498114aa0eac46c57afdb200e42c

    SHA256

    4e486ec3690740147a557fbd540b9cf1abf96d2e62c536eb3eb761b70ff559b5

    SHA512

    33fa8092d3c351b25beca07428e8587ff857d25efae70817a7d5af364b193365bbada41ef7ae02ca48a51f45ffc30931746570f3541b1f8f4f70421ed754a959