Overview
overview
10Static
static
10source_prepared.exe
windows7-x64
7source_prepared.exe
windows10-2004-x64
9discord_to...er.pyc
windows7-x64
3discord_to...er.pyc
windows10-2004-x64
3get_cookies.pyc
windows7-x64
3get_cookies.pyc
windows10-2004-x64
3misc.pyc
windows7-x64
3misc.pyc
windows10-2004-x64
3passwords_grabber.pyc
windows7-x64
3passwords_grabber.pyc
windows10-2004-x64
3source_prepared.pyc
windows7-x64
3source_prepared.pyc
windows10-2004-x64
3Analysis
-
max time kernel
360s -
max time network
364s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 09:02
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral3
Sample
discord_token_grabber.pyc
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
discord_token_grabber.pyc
Resource
win10v2004-20240730-en
Behavioral task
behavioral5
Sample
get_cookies.pyc
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
get_cookies.pyc
Resource
win10v2004-20240730-en
Behavioral task
behavioral7
Sample
misc.pyc
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
misc.pyc
Resource
win10v2004-20240730-en
Behavioral task
behavioral9
Sample
passwords_grabber.pyc
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
passwords_grabber.pyc
Resource
win10v2004-20240730-en
Behavioral task
behavioral11
Sample
source_prepared.pyc
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
source_prepared.pyc
Resource
win10v2004-20240730-en
General
-
Target
source_prepared.exe
-
Size
103.6MB
-
MD5
455a9b01120f5117ffbfcba000b87027
-
SHA1
f903c72e054a3298a67f5301898362d9b2278eb4
-
SHA256
39efcea56e5c786d357d12a813906571bd489b6cd78aa00ed51ed3b612662516
-
SHA512
92219d2ba9517a9881f96ec40ca48f373de2e1d99d4c9bd3ece792ee9c08ee5e51e034dfac781e4417606d6bd65274c233b1df372b778bb0060c57b5f39194ff
-
SSDEEP
3145728:igOb8S6xjKcBaIc2qHO5iVY2nGQbRe0zJcBWNs9U:GgSWNaIsHCiH1XcBWy
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
source_prepared.exepid process 3060 source_prepared.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
source_prepared.exepid process 3060 source_prepared.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
source_prepared.exedescription pid process target process PID 3040 wrote to memory of 3060 3040 source_prepared.exe source_prepared.exe PID 3040 wrote to memory of 3060 3040 source_prepared.exe source_prepared.exe PID 3040 wrote to memory of 3060 3040 source_prepared.exe source_prepared.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3060
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1