Overview
overview
8Static
static
8Blank-Grab...er.bat
windows11-21h2-x64
8Blank-Grab...OBF.py
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...der.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ar.exe
windows11-21h2-x64
3Blank-Grab...un.bat
windows11-21h2-x64
1Blank-Grab...ief.py
windows11-21h2-x64
3Blank-Grab...tub.py
windows11-21h2-x64
3Blank-Grab...px.exe
windows11-21h2-x64
7Blank-Grab...tes.py
windows11-21h2-x64
3Blank-Grab...gui.py
windows11-21h2-x64
3Blank-Grab...er.bat
windows11-21h2-x64
1Blank-Grab...OBF.py
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...10.pyc
windows11-21h2-x64
3Blank-Grab...der.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ess.py
windows11-21h2-x64
3Blank-Grab...ar.exe
windows11-21h2-x64
3Blank-Grab...un.bat
windows11-21h2-x64
1Blank-Grab...ief.py
windows11-21h2-x64
3Blank-Grab...tub.py
windows11-21h2-x64
3Blank-Grab...px.exe
windows11-21h2-x64
7Blank-Grab...tes.py
windows11-21h2-x64
3Blank-Grab...gui.py
windows11-21h2-x64
3Resubmissions
13/07/2024, 23:11 UTC
240713-26p46asgld 813/07/2024, 20:33 UTC
240713-zb9h7swdpk 811/07/2024, 21:44 UTC
240711-1lnj6axfpd 811/07/2024, 21:32 UTC
240711-1d16aaxcrf 811/07/2024, 21:29 UTC
240711-1b5qpaxcke 811/07/2024, 21:25 UTC
240711-z9kmqsvcnm 811/07/2024, 21:22 UTC
240711-z7xvaavbrp 811/07/2024, 21:20 UTC
240711-z6q1cavbmj 811/07/2024, 21:16 UTC
240711-z4v7aawhrd 8Analysis
-
max time kernel
426s -
max time network
441s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/07/2024, 23:11 UTC
Behavioral task
behavioral1
Sample
Blank-Grabber-main/Blank Grabber/Builder.bat
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
Blank-Grabber-main/Blank Grabber/Components/BlankOBF.py
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/process.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
Blank-Grabber-main/Blank Grabber/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
Blank-Grabber-main/Blank Grabber/Components/loader.py
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
Blank-Grabber-main/Blank Grabber/Components/postprocess.py
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
Blank-Grabber-main/Blank Grabber/Components/process.py
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
Blank-Grabber-main/Blank Grabber/Components/rar.exe
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
Blank-Grabber-main/Blank Grabber/Components/run.bat
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
Blank-Grabber-main/Blank Grabber/Components/sigthief.py
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
Blank-Grabber-main/Blank Grabber/Components/stub.py
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
Blank-Grabber-main/Blank Grabber/Components/upx.exe
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
Blank-Grabber-main/Blank Grabber/Extras/unblock_sites.py
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
Blank-Grabber-main/Blank Grabber/gui.py
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
Blank-Grabber-main/grabb/Builder.bat
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
Blank-Grabber-main/grabb/Components/BlankOBF.py
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
Blank-Grabber-main/grabb/Components/__pycache__/BlankOBF.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
Blank-Grabber-main/grabb/Components/__pycache__/process.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
Blank-Grabber-main/grabb/Components/__pycache__/sigthief.cpython-310.pyc
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
Blank-Grabber-main/grabb/Components/loader.py
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
Blank-Grabber-main/grabb/Components/postprocess.py
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
Blank-Grabber-main/grabb/Components/process.py
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
Blank-Grabber-main/grabb/Components/rar.exe
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
Blank-Grabber-main/grabb/Components/run.bat
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
Blank-Grabber-main/grabb/Components/sigthief.py
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
Blank-Grabber-main/grabb/Components/stub.py
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
Blank-Grabber-main/grabb/Components/upx.exe
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
Blank-Grabber-main/grabb/Extras/unblock_sites.py
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
Blank-Grabber-main/grabb/gui.py
Resource
win11-20240709-en
General
-
Target
Blank-Grabber-main/grabb/Components/postprocess.py
-
Size
2KB
-
MD5
bbed9f3d87c4927b2b2bc16a6ec4da51
-
SHA1
c3bceb8a6fb5207abc75039e5a66afbf8324cd8f
-
SHA256
72eefc2defd861c48721f235717a0f8de430ea8f2bc290b429cfbdc906ba539c
-
SHA512
352cd87d379e0a338d44f3933b6b135a36ebe83607157dfe28330ec2c03c6b2bcbbb2d43b1a06487675eea662c76084b3f9777f5b8d0c9132d50869318fc3c78
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4040 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\grabb\Components\postprocess.py1⤵
- Modifies registry class
PID:1704
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4040
Network
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request27.73.42.20.in-addr.arpaIN PTRResponse