Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2023 21:20

General

  • Target

    discord_token_grabber.pyc

  • Size

    17KB

  • MD5

    db40ce247b464d3ac0d15080f22ce442

  • SHA1

    eb10f081e16c9566f1b487d39eda3fb8fa4b0de5

  • SHA256

    74475975b9fc2e15a1432b8e4930b6a8a25dd63511bbc2628ae81483dd569046

  • SHA512

    c614c93d3ad758bfe1155864328626b98900e95e06c504641f0286ee40e4e0e24eb4d83b06af576e7799d517aae8404f5c9acdc64315c594319c29e13a77b81e

  • SSDEEP

    384:cGllyAavwW9FaOx817PPQviowoYbCj+MoGWTd0Da8:cIlytvN9oOx8JnQ6owoYOyMImDa8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
    1⤵
    • Modifies registry class
    PID:4832
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1968
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:3080
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

      Filesize

      16KB

      MD5

      739a878245bfceca7594374596909db4

      SHA1

      2515778a3a38349a4c6517a18604ad1e029396c8

      SHA256

      83e1dccc4a5ceb78007e6c0802a8d966ee187fafa27b96f95dc1b4b296aa2447

      SHA512

      4dde316457c95095965fbd3af35f09f58f5d001bb3441901431d3080c965508c0ac3bb1c7d4736b807fc6e547b61c78cc69fa78ed255dcf7fc6eb685b8fc4688

    • memory/4756-40-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-33-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-42-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-34-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-35-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-38-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-37-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-36-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-43-0x00000220749E0000-0x00000220749E1000-memory.dmp

      Filesize

      4KB

    • memory/4756-0-0x000002206C6A0000-0x000002206C6B0000-memory.dmp

      Filesize

      64KB

    • memory/4756-68-0x0000022074C30000-0x0000022074C31000-memory.dmp

      Filesize

      4KB

    • memory/4756-32-0x0000022074D90000-0x0000022074D91000-memory.dmp

      Filesize

      4KB

    • memory/4756-39-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB

    • memory/4756-44-0x00000220749D0000-0x00000220749D1000-memory.dmp

      Filesize

      4KB

    • memory/4756-46-0x00000220749E0000-0x00000220749E1000-memory.dmp

      Filesize

      4KB

    • memory/4756-49-0x00000220749D0000-0x00000220749D1000-memory.dmp

      Filesize

      4KB

    • memory/4756-52-0x0000022074910000-0x0000022074911000-memory.dmp

      Filesize

      4KB

    • memory/4756-16-0x000002206C7A0000-0x000002206C7B0000-memory.dmp

      Filesize

      64KB

    • memory/4756-64-0x0000022074B10000-0x0000022074B11000-memory.dmp

      Filesize

      4KB

    • memory/4756-66-0x0000022074B20000-0x0000022074B21000-memory.dmp

      Filesize

      4KB

    • memory/4756-67-0x0000022074B20000-0x0000022074B21000-memory.dmp

      Filesize

      4KB

    • memory/4756-41-0x0000022074DC0000-0x0000022074DC1000-memory.dmp

      Filesize

      4KB