Overview
overview
10Static
static
10GOBLIN SERVICES.exe
windows7-x64
7GOBLIN SERVICES.exe
windows10-2004-x64
9discord_to...er.pyc
windows7-x64
3discord_to...er.pyc
windows10-2004-x64
3get_cookies.pyc
windows7-x64
3get_cookies.pyc
windows10-2004-x64
3misc.pyc
windows7-x64
3misc.pyc
windows10-2004-x64
3passwords_grabber.pyc
windows7-x64
3passwords_grabber.pyc
windows10-2004-x64
3source_prepared.pyc
windows7-x64
3source_prepared.pyc
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2023 21:20
Behavioral task
behavioral1
Sample
GOBLIN SERVICES.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
GOBLIN SERVICES.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
discord_token_grabber.pyc
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
discord_token_grabber.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral5
Sample
get_cookies.pyc
Resource
win7-20231201-en
Behavioral task
behavioral6
Sample
get_cookies.pyc
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
misc.pyc
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
misc.pyc
Resource
win10v2004-20231130-en
Behavioral task
behavioral9
Sample
passwords_grabber.pyc
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
passwords_grabber.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
source_prepared.pyc
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
source_prepared.pyc
Resource
win10v2004-20231127-en
General
-
Target
discord_token_grabber.pyc
-
Size
17KB
-
MD5
db40ce247b464d3ac0d15080f22ce442
-
SHA1
eb10f081e16c9566f1b487d39eda3fb8fa4b0de5
-
SHA256
74475975b9fc2e15a1432b8e4930b6a8a25dd63511bbc2628ae81483dd569046
-
SHA512
c614c93d3ad758bfe1155864328626b98900e95e06c504641f0286ee40e4e0e24eb4d83b06af576e7799d517aae8404f5c9acdc64315c594319c29e13a77b81e
-
SSDEEP
384:cGllyAavwW9FaOx817PPQviowoYbCj+MoGWTd0Da8:cIlytvN9oOx8JnQ6owoYOyMImDa8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 4756 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1968 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc1⤵
- Modifies registry class
PID:4832
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1968
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3080
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5739a878245bfceca7594374596909db4
SHA12515778a3a38349a4c6517a18604ad1e029396c8
SHA25683e1dccc4a5ceb78007e6c0802a8d966ee187fafa27b96f95dc1b4b296aa2447
SHA5124dde316457c95095965fbd3af35f09f58f5d001bb3441901431d3080c965508c0ac3bb1c7d4736b807fc6e547b61c78cc69fa78ed255dcf7fc6eb685b8fc4688