eb06b198bf42d7c35111dc76c27db1f77bfba7b034081183614f938d07d26269

Resubmissions

19-04-2024 04:24

240419-e1tttshf8y 10

19-04-2024 04:20

240419-eygrgshe9s 10

19-04-2024 04:05

240419-eny8sagb93 10

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord_token_grabber.pyc
Size

17KB
MD5

db40ce247b464d3ac0d15080f22ce442
SHA1

eb10f081e16c9566f1b487d39eda3fb8fa4b0de5
SHA256

74475975b9fc2e15a1432b8e4930b6a8a25dd63511bbc2628ae81483dd569046
SHA512

c614c93d3ad758bfe1155864328626b98900e95e06c504641f0286ee40e4e0e24eb4d83b06af576e7799d517aae8404f5c9acdc64315c594319c29e13a77b81e
SSDEEP

384:cGllyAavwW9FaOx817PPQviowoYbCj+MoGWTd0Da8:cIlytvN9oOx8JnQ6owoYOyMImDa8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2648 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2648 AcroRd32.exe
2648 AcroRd32.exe

pid	process
2648	AcroRd32.exe

pid	process
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2228 wrote to memory of 2724	2228	cmd.exe	rundll32.exe
PID 2228 wrote to memory of 2724	2228	cmd.exe	rundll32.exe
PID 2228 wrote to memory of 2724	2228	cmd.exe	rundll32.exe
PID 2724 wrote to memory of 2648	2724	rundll32.exe	AcroRd32.exe
PID 2724 wrote to memory of 2648	2724	rundll32.exe	AcroRd32.exe
PID 2724 wrote to memory of 2648	2724	rundll32.exe	AcroRd32.exe
PID 2724 wrote to memory of 2648	2724	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2724

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2648

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
7c96447d1ecd4f213a8d9ea045c014fd

SHA1
cd78e9a17d1967c266295f8b01812853255f983b

SHA256
f105af96fea3c2f3d99dce7b835707ef2629c70e8f56cc40e59a17bb750c517e

SHA512
53e4eb42ec8495eafae15dfd12a4a6658cfdec88e1a4d2a12fefde69a8b2c8dc5e4d1556d681bda995871a7a1698c6370d6f789cf2ece387fbe77c5fb1389b47

Download Submit