Analysis

  • max time kernel
    1561s
  • max time network
    1564s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2023 19:43

General

  • Target

    discord_token_grabber.pyc

  • Size

    17KB

  • MD5

    e523026b612006e580e96bd9e2a8882c

  • SHA1

    03b9938701f7eff11a0c3632ed805e8188598c88

  • SHA256

    8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77

  • SHA512

    a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853

  • SSDEEP

    384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    cf63d7c4dd69526c761ac6829167334e

    SHA1

    566537c3b5ef0929c77f4f16766dd744b6ddf524

    SHA256

    0b899d1903a637805cbeea2b277ad1dd6b7812268e8dc2bda3ec2ed2d01650fa

    SHA512

    ff5c8f570eb4e718dbfc113d6cd02aaf4eddfcf9273e7e337b03a62db18a15cdb45e6fb75654776ff72fe004d447bb2cd1fa456637b6bb98d45d5a7614951a63