Overview
overview
10Static
static
10w-azure fixed.exe
windows7-x64
7w-azure fixed.exe
windows10-2004-x64
9discord_to...er.pyc
windows7-x64
3discord_to...er.pyc
windows10-2004-x64
3get_cookies.pyc
windows7-x64
3get_cookies.pyc
windows10-2004-x64
3misc.pyc
windows7-x64
3misc.pyc
windows10-2004-x64
3passwords_grabber.pyc
windows7-x64
3passwords_grabber.pyc
windows10-2004-x64
3source_prepared.pyc
windows7-x64
3source_prepared.pyc
windows10-2004-x64
3Analysis
-
max time kernel
1561s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 16:07
Behavioral task
behavioral1
Sample
w-azure fixed.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
w-azure fixed.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral3
Sample
discord_token_grabber.pyc
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
discord_token_grabber.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral5
Sample
get_cookies.pyc
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
get_cookies.pyc
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
misc.pyc
Resource
win7-20231201-en
Behavioral task
behavioral8
Sample
misc.pyc
Resource
win10v2004-20231130-en
Behavioral task
behavioral9
Sample
passwords_grabber.pyc
Resource
win7-20231130-en
Behavioral task
behavioral10
Sample
passwords_grabber.pyc
Resource
win10v2004-20231130-en
Behavioral task
behavioral11
Sample
source_prepared.pyc
Resource
win7-20231130-en
Behavioral task
behavioral12
Sample
source_prepared.pyc
Resource
win10v2004-20231130-en
General
-
Target
w-azure fixed.exe
-
Size
79.2MB
-
MD5
386c55fcc2cdedd0582fcde5a692cb5c
-
SHA1
460f1ffc5a0426326c5e01bb7bc9ac03b0db68d0
-
SHA256
f633400fb27c3202b88f03ac6ab94d48007c51158419019300dfdb8730924b60
-
SHA512
73f3dedae22847a2d6989c5ed97ed799f50aa8b5789e3e12933d3b4712ce1d959af828d47bce391b3cd1fae4ae0c7f95669cbef1134b31b5aadda8bb9832ae54
-
SSDEEP
1572864:W2MbiJR5Q3jewElSk8IpG7V+VPhqArIE7DjCNtOWlsnghowmaOll8WCaw9FVBCds:WZbC+CJSkB05awArlu/dsghfxOll8taN
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
w-azure fixed.exepid process 2632 w-azure fixed.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI29682\python311.dll upx \Users\Admin\AppData\Local\Temp\_MEI29682\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
w-azure fixed.exedescription pid process target process PID 2968 wrote to memory of 2632 2968 w-azure fixed.exe w-azure fixed.exe PID 2968 wrote to memory of 2632 2968 w-azure fixed.exe w-azure fixed.exe PID 2968 wrote to memory of 2632 2968 w-azure fixed.exe w-azure fixed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\w-azure fixed.exe"C:\Users\Admin\AppData\Local\Temp\w-azure fixed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\w-azure fixed.exe"C:\Users\Admin\AppData\Local\Temp\w-azure fixed.exe"2⤵
- Loads dropped DLL
PID:2632
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab