Overview
overview
8Static
static
8Blank-Grab...er.bat
windows11-21h2-x64
8Blank-Grab...OBF.py
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...der.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ar.exe
windows11-21h2-x64
3Blank-Grab...un.bat
windows11-21h2-x64
1Blank-Grab...ief.py
windows11-21h2-x64
3Blank-Grab...tub.py
windows11-21h2-x64
3Blank-Grab...px.exe
windows11-21h2-x64
7Blank-Grab...tes.py
windows11-21h2-x64
3Blank-Grab...gui.py
windows11-21h2-x64
3Blank-Grab...er.bat
windows11-21h2-x64
1Blank-Grab...OBF.py
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...der.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ar.exe
windows11-21h2-x64
3Blank-Grab...un.bat
windows11-21h2-x64
1Blank-Grab...ief.py
windows11-21h2-x64
3Blank-Grab...tub.py
windows11-21h2-x64
3Blank-Grab...px.exe
windows11-21h2-x64
7Blank-Grab...tes.py
windows11-21h2-x64
3Blank-Grab...gui.py
windows11-21h2-x64
3Resubmissions
13/07/2024, 23:11
240713-26p46asgld 813/07/2024, 20:33
240713-zb9h7swdpk 811/07/2024, 21:44
240711-1lnj6axfpd 811/07/2024, 21:32
240711-1d16aaxcrf 811/07/2024, 21:29
240711-1b5qpaxcke 811/07/2024, 21:25
240711-z9kmqsvcnm 811/07/2024, 21:22
240711-z7xvaavbrp 811/07/2024, 21:20
240711-z6q1cavbmj 811/07/2024, 21:16
240711-z4v7aawhrd 8Analysis
-
max time kernel
438s -
max time network
440s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/07/2024, 23:11
Behavioral task
behavioral1
Sample
Blank-Grabber-main/Blank Grabber/Builder.bat
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
Blank-Grabber-main/Blank Grabber/Components/BlankOBF.py
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/process.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
Blank-Grabber-main/Blank Grabber/Components/loader.py
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
Blank-Grabber-main/Blank Grabber/Components/postprocess.py
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
Blank-Grabber-main/Blank Grabber/Components/process.py
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
Blank-Grabber-main/Blank Grabber/Components/rar.exe
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
Blank-Grabber-main/Blank Grabber/Components/run.bat
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
Blank-Grabber-main/Blank Grabber/Components/stub.py
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
Blank-Grabber-main/Blank Grabber/Components/upx.exe
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
Blank-Grabber-main/Blank Grabber/Extras/unblock_sites.py
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
Blank-Grabber-main/Blank Grabber/gui.py
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
Blank-Grabber-main/grabb/Builder.bat
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
Blank-Grabber-main/grabb/Components/BlankOBF.py
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
Blank-Grabber-main/grabb/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
Blank-Grabber-main/grabb/Components/__pycache__/process.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
Blank-Grabber-main/grabb/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
Blank-Grabber-main/grabb/Components/loader.py
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
Blank-Grabber-main/grabb/Components/postprocess.py
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
Blank-Grabber-main/grabb/Components/process.py
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
Blank-Grabber-main/grabb/Components/rar.exe
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
Blank-Grabber-main/grabb/Components/run.bat
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
Blank-Grabber-main/grabb/Components/sigthief.py
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
Blank-Grabber-main/grabb/Components/stub.py
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
Blank-Grabber-main/grabb/Components/upx.exe
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
Blank-Grabber-main/grabb/Extras/unblock_sites.py
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
Blank-Grabber-main/grabb/gui.py
Resource
win11-20240709-en
General
-
Target
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
-
Size
10KB
-
MD5
57156b83bcfa0c8cbc0fc36aa02a1617
-
SHA1
a6aaf0f1e05924e6c6a27918f406c620cacf7a01
-
SHA256
caf899aedb2b0fe154de2223d86604380d2cf4a47406f881cca680c8a4b063bf
-
SHA512
63b8944298cdc7323ee7b193efa75018a759d10c6933d430ad62779231b9daca6b2dfd0fcac8e69b5846474b83c1deae5b82606d88c26bebad5bb31d50ff883e
-
SSDEEP
192:J/j5U9+6E0yWYSF/DwI6CRH2dCYwqSfU15dkAJH:J6yMSfUU1l
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2240 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\Blank Grabber\Components\sigthief.py"1⤵
- Modifies registry class
PID:5028
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2240