Overview
overview
10Static
static
10Grabbers-D...obf.py
windows11-21h2-x64
3Grabbers-D...ben.py
windows11-21h2-x64
3Grabbers-D...ank.py
windows11-21h2-x64
3Grabbers-D...ean.py
windows11-21h2-x64
3Grabbers-D...una.py
windows11-21h2-x64
3Grabbers-D...obf.py
windows11-21h2-x64
3Grabbers-D...her.py
windows11-21h2-x64
3Grabbers-D...er.jar
windows11-21h2-x64
7Grabbers-D...pycdas
windows11-21h2-x64
1Grabbers-D...as.exe
windows11-21h2-x64
1Grabbers-D.../pycdc
windows11-21h2-x64
1Grabbers-D...dc.exe
windows11-21h2-x64
1Grabbers-D...in/upx
windows11-21h2-x64
7Grabbers-D...px.exe
windows11-21h2-x64
7Grabbers-D...fig.py
windows11-21h2-x64
3Grabbers-D...ile.py
windows11-21h2-x64
3Grabbers-D...ion.py
windows11-21h2-x64
3Grabbers-D...lay.py
windows11-21h2-x64
3Grabbers-D...oad.py
windows11-21h2-x64
3Grabbers-D...t__.py
windows11-21h2-x64
3Grabbers-D...aes.py
windows11-21h2-x64
3Grabbers-D...der.py
windows11-21h2-x64
3Grabbers-D...til.py
windows11-21h2-x64
3Grabbers-D...tor.py
windows11-21h2-x64
3Grabbers-D...rng.py
windows11-21h2-x64
3Grabbers-D...ler.py
windows11-21h2-x64
3Grabbers-D...ons.py
windows11-21h2-x64
3Grabbers-D...ram.py
windows11-21h2-x64
3Grabbers-D...mer.py
windows11-21h2-x64
3Zyron.exe
windows11-21h2-x64
10Analysis
-
max time kernel
452s -
max time network
1173s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
31-05-2024 17:38
Behavioral task
behavioral1
Sample
Grabbers-Deobfuscator-main/deobf.py
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
Grabbers-Deobfuscator-main/methods/ben.py
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
Grabbers-Deobfuscator-main/methods/blank.py
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
Grabbers-Deobfuscator-main/methods/empyrean.py
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
Grabbers-Deobfuscator-main/methods/luna.py
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
Grabbers-Deobfuscator-main/methods/notobf.py
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Grabbers-Deobfuscator-main/methods/other.py
Resource
win11-20240419-en
Behavioral task
behavioral8
Sample
Grabbers-Deobfuscator-main/utils/bin/fernflower.jar
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
Grabbers-Deobfuscator-main/utils/bin/pycdas
Resource
win11-20240426-en
Behavioral task
behavioral10
Sample
Grabbers-Deobfuscator-main/utils/bin/pycdas.exe
Resource
win11-20240426-en
Behavioral task
behavioral11
Sample
Grabbers-Deobfuscator-main/utils/bin/pycdc
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
Grabbers-Deobfuscator-main/utils/bin/pycdc.exe
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
Grabbers-Deobfuscator-main/utils/bin/upx
Resource
win11-20240508-en
Behavioral task
behavioral14
Sample
Grabbers-Deobfuscator-main/utils/bin/upx.exe
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
Grabbers-Deobfuscator-main/utils/config.py
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
Grabbers-Deobfuscator-main/utils/decompile.py
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
Grabbers-Deobfuscator-main/utils/deobfuscation.py
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
Grabbers-Deobfuscator-main/utils/display.py
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
Grabbers-Deobfuscator-main/utils/download.py
Resource
win11-20240426-en
Behavioral task
behavioral20
Sample
Grabbers-Deobfuscator-main/utils/pyaes/__init__.py
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
Grabbers-Deobfuscator-main/utils/pyaes/aes.py
Resource
win11-20240426-en
Behavioral task
behavioral22
Sample
Grabbers-Deobfuscator-main/utils/pyaes/blockfeeder.py
Resource
win11-20240508-en
Behavioral task
behavioral23
Sample
Grabbers-Deobfuscator-main/utils/pyaes/util.py
Resource
win11-20240426-en
Behavioral task
behavioral24
Sample
Grabbers-Deobfuscator-main/utils/pyinstaller/extractors/pyinstxtractor.py
Resource
win11-20240426-en
Behavioral task
behavioral25
Sample
Grabbers-Deobfuscator-main/utils/pyinstaller/extractors/pyinstxtractorng.py
Resource
win11-20240508-en
Behavioral task
behavioral26
Sample
Grabbers-Deobfuscator-main/utils/pyinstaller/pyinstaller.py
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
Grabbers-Deobfuscator-main/utils/pyinstaller/pyinstallerExceptions.py
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
Grabbers-Deobfuscator-main/utils/telegram.py
Resource
win11-20240508-en
Behavioral task
behavioral29
Sample
Grabbers-Deobfuscator-main/utils/webhookspammer.py
Resource
win11-20240426-en
General
-
Target
Grabbers-Deobfuscator-main/utils/bin/fernflower.jar
-
Size
690KB
-
MD5
be01dbc47a455dddfc724d5efe13b490
-
SHA1
0d96a3b0cb32a0e70cc563a2dcdcea5ef61d45b5
-
SHA256
74b609647d74e4ce04e9beef230a7460e74de03bf41703f961bbe704d4938b8f
-
SHA512
4ee6e1b935bc428e16103485da5440ae5b968334f023c7872247d52f1d0c000f8f49bc9101e955999c0338c88d34392f14eff2143c167675f7f5888a0be91094
-
SSDEEP
12288:lSBknFucLVNrGJASNYa5k3qIhOhsioN46D2xFGDwHyhfsYFY5D/:lUcLVNEA0N5kaVhBjGDdhkYUD
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 1376 wrote to memory of 3308 1376 java.exe icacls.exe PID 1376 wrote to memory of 3308 1376 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Grabbers-Deobfuscator-main\utils\bin\fernflower.jar1⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:3308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD59c26444eb054e3f95d03302e5acf9a64
SHA12af69d919c0b37447c479238c5a81e2e1d90bf72
SHA256c25aafa7dfaac7e0aeef9617c39f0319ac9d333f088852111fa99622347ba1d1
SHA512cc22143b24676b1576aed2cd3220608e9d65fd52b42b62b5ce96626fb6df159bae9e2a3e59118e5a8674fb8b7e67e88222c10b41b13b0759a05a18cab1b1902c
-
memory/1376-2-0x0000029712930000-0x0000029712BA0000-memory.dmpFilesize
2.4MB
-
memory/1376-13-0x0000029710F60000-0x0000029710F61000-memory.dmpFilesize
4KB
-
memory/1376-14-0x0000029712930000-0x0000029712BA0000-memory.dmpFilesize
2.4MB