Overview
overview
10Static
static
10source_prepared.exe
windows10-1703-x64
7source_prepared.exe
windows10-2004-x64
7source_prepared.exe
windows11-21h2-x64
7discord_to...er.pyc
windows10-1703-x64
3discord_to...er.pyc
windows10-2004-x64
3discord_to...er.pyc
windows11-21h2-x64
3get_cookies.pyc
windows10-1703-x64
3get_cookies.pyc
windows10-2004-x64
3get_cookies.pyc
windows11-21h2-x64
3misc.pyc
windows10-1703-x64
3misc.pyc
windows10-2004-x64
3misc.pyc
windows11-21h2-x64
3passwords_grabber.pyc
windows10-1703-x64
3passwords_grabber.pyc
windows10-2004-x64
3passwords_grabber.pyc
windows11-21h2-x64
3source_prepared.pyc
windows10-1703-x64
3source_prepared.pyc
windows10-2004-x64
3source_prepared.pyc
windows11-21h2-x64
3Analysis
- max time kernel
135s - max time network
136s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
18/06/2024, 10:45
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
source_prepared.exe
Resource
win11-20240419-en
Behavioral task
behavioral4
Sample
discord_token_grabber.pyc
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
discord_token_grabber.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
discord_token_grabber.pyc
Resource
win11-20240611-en
Behavioral task
behavioral7
Sample
get_cookies.pyc
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
get_cookies.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
get_cookies.pyc
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
misc.pyc
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
misc.pyc
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
misc.pyc
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
passwords_grabber.pyc
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
passwords_grabber.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
passwords_grabber.pyc
Resource
win11-20240611-en
Behavioral task
behavioral16
Sample
source_prepared.pyc
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
source_prepared.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
source_prepared.pyc
Resource
win11-20240611-en
General
- Target misc.pyc
- Size 2KB
- Sample240618-mtkatazejc
- SHA256 572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a
- MD5 bcb404423ac51f798753e8d11e401071
- SHA1 9080018dae3aa157e3a97904c86af06d4a0a6873
- SHA512 25a2997cff19308956086ae4e464f5039e53149043f094f2a65dae4dfa78b6410650a3c4d1514511f23c6bf77228772fa7b8a3cf5119e4ed46edb65ac40ff800
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3768 OpenWith.exe