Analysis
- max time kernel
1508s - max time network
1473s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/02/2024, 12:12
General
- Target passwords_grabber.pyc
- Size 4KB
- Sample240204-pdjepabber
- SHA256 589d438226abfec8f71ab7724c68011303f82febb6786fd0c57571b0769764f3
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3316-0-0x0000021732E40000-0x0000021732E50000-memory.dmp
memory/3316-16-0x0000021732F40000-0x0000021732F50000-memory.dmp
memory/3316-32-0x000002173B4C0000-0x000002173B4C1000-memory.dmp
memory/3316-33-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-34-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-35-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-36-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-37-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-38-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-39-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-40-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-41-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-42-0x000002173B4F0000-0x000002173B4F1000-memory.dmp
memory/3316-43-0x000002173B110000-0x000002173B111000-memory.dmp
memory/3316-44-0x000002173B100000-0x000002173B101000-memory.dmp
memory/3316-46-0x000002173B110000-0x000002173B111000-memory.dmp
memory/3316-49-0x000002173B100000-0x000002173B101000-memory.dmp
memory/3316-52-0x000002173B040000-0x000002173B041000-memory.dmp
memory/3316-64-0x000002173B240000-0x000002173B241000-memory.dmp
memory/3316-66-0x000002173B250000-0x000002173B251000-memory.dmp
memory/3316-67-0x000002173B250000-0x000002173B251000-memory.dmp
memory/3316-68-0x000002173B360000-0x000002173B361000-memory.dmp