Analysis
-
max time kernel
45s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/09/2024, 11:31
General
-
Target
Grabber_3.2.0.exe
-
Size
7.6MB
-
MD5
cabcf8d6b681acf08cc0b52425479f1f
-
SHA1
e86d4430615522b6e34ec26c406ade6c278295b1
-
SHA256
6f6fcfcf9bd7990889c0cc6ccb6daa3511059810d8047a52d12e0946f5d973e0
-
SHA512
c763547adcc825b7a5ed5c2ca99b6a8898e32fb6051b8358f957659af184ca4a1aa4db700c5b4110103591519380813cbd4dd1bb43781eae0489e80ada2f2ad6
-
SSDEEP
196608:n/K4vs9RytHdqYAUoj922ZjShQBKw2lNW8H2M:n/bEOpdIUooOwWHM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 24 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 29 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Grabber_3.2.0.exe"C:\Users\Admin\AppData\Local\Temp\Grabber_3.2.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C1V2C.tmp\Grabber_3.2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-C1V2C.tmp\Grabber_3.2.0.tmp" /SL5="$70040,7598635,148992,C:\Users\Admin\AppData\Local\Temp\Grabber_3.2.0.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Grabber\Grabber.exe"C:\Program Files (x86)\Grabber\Grabber.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Grabber\unins000.exe"C:\Program Files (x86)\Grabber\unins000.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files (x86)\Grabber\unins000.exe" /FIRSTPHASEWND=$2027E2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5c6e9e5fff09edea3892127653c200865
SHA155e96b075c974e7067647d3118f5e3bd0d27f11e
SHA256600e0111bd18b88b73a28324d9c92a4591fcf89af12978034b2886bf1262bd33
SHA51234aacfa1dbf70b82a18b708b68e524676f02282e946292f7414a0632e637013431dad13433724cf96245e392c247123ac99320191ca2cb454c018f7be3f66256
-
Filesize
2.4MB
MD5d4e47b8ffd656887676bb24a706a92e1
SHA1e6ba6799492cf66860805c4f2d7e24713e36c09e
SHA25670add986b42e49674e8fcf23de44b7fa1455c03c035c9b2b7f567fccc9636442
SHA5122b08af1d385868c9094d96192c854309d1de39605e9b2d30d678cf3ed31d084471591d7714b519b237322922be5eccfe0142ae2ab1902fcb573e00520f6b9b5e
-
Filesize
9.5MB
MD5b72df6af66c7bc3d30edeae85604ee12
SHA113fa741ea4bee17d918a0aea096a813de9a8d94d
SHA2567cc1e34f43f629f3f38f0445aadd1f9959bf215a8cd8e90055d2bee80c3f1c17
SHA51240164dba7ae4efa16e43f165256ef65286e5279363eab3d7d115460df2c27d34aeafb92bf637f9d13b157ca22560dcc27098a3361c832ab789f00f7a06406717
-
Filesize
1.2MB
MD5e813af7ab323c78996503a541aa11d2d
SHA1ad1f58bb4cd4b1873a7c68d2826400f3d7c37950
SHA2566a606de7cc50c9ac56594e677c76f25c0c6e18665afe11c6c627e0e09166c8bf
SHA512cfd58efe4a9f461d5dcef27c83791cd07834217c2a74808a38b1129485c68159b8e4d349df494f780922e50dbf928a9916ee2ddc395f56e65625e710d0df4bce
-
Filesize
2.1MB
MD5bd2c76dd17ebc4dac5fd0d423ca9901e
SHA13e2bf1d120d977300f3e498dab08ead25ebca668
SHA256b9a92329aa66e4c38688dde476e5d7591b231b398943737103b1b17635dc2ea2
SHA5120d8bfb1ec7453d4258ed23f9874d8274f273c0a861094360b0484867a9f98ab09efa5aa7ddc0c59a401a90f4392de88742d5add399682bed03758958136b0b1f
-
Filesize
265KB
MD595fa495f87d6a0fa734c4cd945fbf6a9
SHA17b8932d6e83962b866b41aac981b0b0d6d7de3ce
SHA256ace9938db08376477f1d657aff051333321663656d36a366ba7fa0141cc2f4b2
SHA512773565b8742c1a798225d8f163dce8d5884da33463fcbf8403f4266b17ca1852e138f28d7098e7cd545e2514350ecc7fdbf2e8c4bf10dce3a41b2cbe7bab6619
-
Filesize
390KB
MD579c9c0268179547a7e13798e67a36f7a
SHA1c8c784cbd5a5503c0ec02d23556e14147d84d47c
SHA25663566534ed72d1ac4a9370264bbe1cb582eb13d7c6a0cf08247559b651c46c92
SHA51292fff046889146cd280e67eb2b9201eabe1fe3bbd3c9e2bed3bf6aea3502faf868f7a95e8f80948406fc2b727738ea0dc26ad4782288300beeb073c8fe52d5a5
-
Filesize
81KB
MD5c1a9719af134cf82270f757cf32993eb
SHA1966f1221b39d84ec7bcf367648a5ca7bf68e8f4b
SHA25657712a17c64f29c9f2b0b85053627e1e0570e9fa421b15c326eaff69b9d5b71a
SHA5125be3a8162409a4039ff73c52af5533e491ab92c3e40d41088105d7c8f500e5dab11c688cb65c5088b2be95f134ab60aeeee9a5f21ae43bdc9091bbe75ddefd32
-
Filesize
80KB
MD58ff1723c1087b6bc56c45a57c5e0e441
SHA11a460be8bcc57d75e866195b885aa4756488c7b4
SHA256370ebe80e4e7cc95e945493fe31ac0a255f3810a335ab79f947d98b51014f412
SHA5120599c589ed74ec6ae36b0952eb2915f2279ad97e667292f01727bad7823d1fb8cfabe346fb568dc118dfc5e3f6115c87397cdbacd30a0468e4dabd20b08549dc
-
Filesize
187KB
MD56246500d1310942b9829509ce7036c14
SHA1d97928c6473e7302aabc9a22668fb347ea849cd6
SHA2562a1f35d978e7c45e8febf839bebe2b133b5789054b9f516fa91ae0b42fc8e509
SHA512155e1506de893d2e36908b62ee6fd0b4a42a45d69f8f1a19dbc4238caacd5411b1323731d2d15de78ea4790b01a0ee3c33333268de6dac5958cffb7bb83bfd99
-
Filesize
342KB
MD52512ba8d4a22c017a782c673e47cc7a4
SHA10f2c30f593572976abac3ab686b83d0a0b3d3589
SHA256abdb48d13aa60ef21c340e42f9cf7fe2d3d84fbcf14ab4498086dc06388f1be6
SHA512a19ffb4177d6e747b30da077c9db7e27784a6f0ecb8f17db881fa1adc2567530b69d92166851a253e13dac75c87a448de5c3dad3580b9cd6b3a450851505d714
-
Filesize
70KB
MD59012bb490d1d4395e400ca3f24e5d0b5
SHA1e60734ce9740963cbbfd962ef8fdb2283ebb1f74
SHA256513dd2cfdb443f6aea87d8fba7c6c1755fdb38da65d166cc9b3e6f5362d063f7
SHA5121573eddb22ebb85f765033ef0ddb9efc49457576eb799ca1f63e2b90f2ca27bb7fd8f9dd7d3c6b3b95fd543bea9bba83684f0c8a5016a731bad7d09c8de3b30e
-
Filesize
361KB
MD5949d1034852f829c5508a326279790b9
SHA108ab80ca3509b41f5d41a6e73ad27100de652c6d
SHA2569b76cec8cebb0119bef44a225a9c3dd4fce99f3fbabbaf54e050f3ee1d751076
SHA512a11c9bdba8e9e261dfb42a1dbbab949eece847cc867517c423219ae850714183393a4931c1cfbc8c171b9ef49e13582951ff0094183e461ffaf95eace155a5a2
-
Filesize
89KB
MD5fbe03a1a2d46e70b21268e2d4775951e
SHA1ba43a45b39090f9b8e8a08383f12d7f42da515be
SHA256c651d59264887c18978f5b9101e81f9761750c5bc0dc2a96c6cea22484255620
SHA5121d80dac9e101a11a45bc500bed3871ca1d768944b4d17d8d277a22fbe586e1367626e28583357658dfa0a9cc9d812aaf77baefc319d952191329b4d8898cf8fe
-
Filesize
42KB
MD5c4b4409f186da70fcf2bcc60d5f05489
SHA1056663c9fd2851cd64f39d882f6758e7a987bd42
SHA256b35f2a8f4c8f1833f3cdec20739c58e295758ce22021d03d4335043148bd7610
SHA512cdcb945a82a0304e4d7cfc9ae9d7e5a5e81d4e3025e982494c87c283f6fac542181e9e1e3028456b9b0b5b6279990cb3e1a50f9df0f6e707c70fa0e23c7a808c
-
Filesize
3.8MB
MD50d87daf512930dae58217fb7aa031761
SHA191ae304fff0d91d077020f9c43ebafdab6b13e7b
SHA25600d76ed5cdbba394bfaf741c6ca582180b1c66d4626d0ce8211c9a6e357fa106
SHA512a2aeb38713b69fc75c9b60e5a2a9d04d740d9aa4b1527d731d0adb76b735c052657c3ac000f64aea086425c8da95679d47fbd7090c81cb10666be526476a8852
-
Filesize
11KB
MD5dbda60d92e774b4acb3b1cd71f909426
SHA166bfe06a16025f574323a0ce64dcc7c8216eb56c
SHA25656a59dae638d9bb45ce729a5d6fdfb0ecbe88b37047e4d6d20dbdef1fc90bd72
SHA512993a1f4af21cd5e13c3b8059cf483b10a58beb0d1777703ea07e9dcb5e7f681fa774e770abe9b6b4ca66b348997da0218d0ff67f18fcca1b3ca1ece2551d965a
-
Filesize
2.2MB
MD5d6bcc45d3412fb27089b394cc6233f48
SHA1c91981a6bae4f763080cb4aff495959ca9ece486
SHA25628aaf2dbdccc4d8f77656fa060611d4071c26e9068e24f78051a28f6aac12856
SHA51253a116cff3850bb06c8333f797ef9fa9244d16e2bbc6a533d6b7a1234cdc01d5ab887a2ae36368482637abc05579320a3f1a554ef71a36ae1db8de4dfb2e2372
-
Filesize
112KB
MD50a6189f59b770a3099fefc07356652be
SHA1bf59b3d191db43e649bd8030991b49362ba75523
SHA2564736a0d8a5de5f1994fb4e5b806c601df8ad0cc5af3b35f4b5ecdad4819f1869
SHA512aaf5a51699bcd99a4c9763f435d3168cc4a829bd0dc22e81602500226260d30c95778a5a1e769f21f293d5c6666619209e0429db902de234eaf5e84bb8e7b69c
-
Filesize
4KB
MD5bcb36d2efb1ab331ef9bad0027ac743d
SHA11db2e36b0a4aad1e40961e5e0e47e2bb48a6a619
SHA25687bfcec3816a83b4fa58d2d40f7b2302047f516467469f9b0b2dcba87ab3942a
SHA51240a6acb96f139ec66dc0916020a79b575b32c5e2cf108f626fb627e3667e8563ad08bfe6a56bd168e30ac6bf82959173ca48ac738bcad575cf7b2c37e655680c
-
Filesize
790KB
MD5c429ca29d2a86a11b2d5980c2fcd59a3
SHA1bdcc48665a92fb81e07cc11b6a186904ee24f508
SHA256a5609e015cd8b70562726e90170adb7f8b208c375b5142372de28da79031bcb4
SHA5121df43dc5be69a59aba0ca832888007aaaff03a4b85e969ecc5781e5a3eec667c16e27fd460bf1a62bf3485b3d5591e83e47802419befa8d82f74b79f49593268
-
Filesize
70KB
MD5f9dd11122d9f53694ca5bfef716a48c6
SHA145b50cfd353a5830722bc927be1cc42d88d152a7
SHA256fdf31325f54266129028a8963ab89255b16436f57a3a8a2fbb2efba9968098fa
SHA5129887a6f2450eaab94361549d204af1b26e22870ce6d0e5e4623311f48e06e76a796ff27ec78146e2726aa499eec76504bb17a33f6f8670a79ebf5dd8f35ca43c
-
Filesize
1KB
MD5e2474fa4a9f33bb0c261b08ecc31b732
SHA1f6d87edfb8755b42d272383de223af5553acfc2a
SHA2566cfaf175b88d5552d42c1a841b14d9bf0d87be43a42b868a60520ea85816c838
SHA51281944f294614966e554283fe91ab124bfb9d5369e48e3f5eec1967aca50124bb1415c2591f32b2f92acba9fb3433bbc6a73fdcc0b2922ebb41882afc60e991d4
-
Filesize
780KB
MD533775c6bd7586af5a2fcf86c737cbff6
SHA142d076d89188667adbf9c1d1c9208b7f6f8fcf8c
SHA25619c998a70536702c2471789d0c420a6c907a8f17462edde9c2315bce41d602bf
SHA512a55890dca5296abdfac24f8fd426a38173c47877804f5d13b0078f6c06c578218cfc41caadcf0b77d7ff4ed8dc74116a8e6fa9b82c6857e479c84aadc20dce05
-
Filesize
3KB
MD569383d7c84a14259bf2898c8ce693495
SHA188e8c7c1091dca6bd7869badc5decf154d545b30
SHA256099218bf6cab00198a21c05707c563e7b356f6e93457be70e5e742b0c1dfaba6
SHA512903a7e4d2f8eca1b0987484728767dd3bea39fe8c1404867aa37c02b3df7d869607c9b634e670e50f4dc29d265c780e114611dc8946836ff7e440f725fc97299
-
Filesize
25B
MD503c204d6b90d555e82088a6b46788fe3
SHA165566c349666a8132036e706516385951550e5ff
SHA256a984e7f4f68795c1ebfe4a52c78cc8736d2add29639aab735efc0df0e824bfc6
SHA51265d4c8aff293012785ea7ec6eb9b2a9e07191384e918004840ee02175ff6d251dbd3d2f4d46106161e97080468d1bc1b99f8b25d13221fa21676d42013fa8259
-
Filesize
85B
MD56e999ae2ff961950006f57abf9eadb50
SHA1036fa692800abeb26336dc2e00bed558ae237e9a
SHA25689a5c38044ccdb1088e2544530b2dcc47dff2dbe463f1eb4c62e226deb9ebbbe
SHA51244156ec3145c484c946bc6d2dedcf3d8b2f0847340f7cc53a1cd57fd39ed2c767d0bcf6915cb2d6dc1c54070a13d9326831bcb08ec5f2229a33c824bf20e7e28
-
Filesize
2KB
MD5b6261088d9ed7096a2a49af6572e71b9
SHA1e74118df583f9293224e32b29957cbcbf29754a3
SHA256f1a655e130d46b135704a96a32a0b308edf0f4e0b8b67de89b847479b1f7673b
SHA51230c1df1ebcdc4837d96d0f77be8c8167152df931d9b0ae957ecb48a4106f98fea5cca4405559f98e1dcf35f9745b03eaaa247229505afe03711901ab5ce05334
-
Filesize
3KB
MD5e2f4cab107c2b66b3f7306505c5e719f
SHA1bb14844c566578bda0e03e423df604f01c974f61
SHA256899c428bb4dee6c76399e551450eb769e7389655c7f8aa68910269d3537f57d4
SHA51248af2eb0f58120eb33cd8a3108d700b1376b6cf16172754461ab3f6824ddd26bc3cc87314d92f87dac43fc02c322fe756b2c4d5a68aeca69509c7311d64c6ba9
-
Filesize
2KB
MD5b5f85e5bfca80d670f98f28560e8f682
SHA179d32737831883834dbc8a51d18fc9c5a17b4fa3
SHA25663f4731e3aacbd5eb59fb2d5c861d3b73a1054e7f84dfec659f4530e573092a6
SHA5124fd42f35205c71bf05fbf37816743d25bbb6e90e28b201a91d06a995ce72cb34b9c81be7302359ec2568609e3257de6c2a8d913e945b98ea39fcefb1b9845842
-
Filesize
203B
MD54e6e73c372ac71fba75d65373d29901c
SHA1d1182954e480a4e78ec61f3b5228a3758201745b
SHA256894b7527c0bd133c8e3e50553a12d3ec824002542a64c78bcf90b074b25f3467
SHA512d2bc24ea29b7b52b2022254fd6ce22b5f4e15631857946a286223f70781c4c2e79759abd2b72cf5623e4dd09c11bf647600f68d855641c110468cbdf67f93833
-
Filesize
1KB
MD50921a29c44399b125a9cbd8ab3b4baa6
SHA1ddc4599ce1fe73f07c16e118554ea696601be3e1
SHA2565ddd3d00f83cf90de36214aa4b8c077c939e435473fe077f1cffc87f9546a405
SHA5125862909aa1540050bbb828e229884e3eeeb690971d68a2d1654e46b566d99f5358e4b42828b6bf02b23449b18be9bae7669a5e6ce4f868c89d13b832941b6733
-
Filesize
45B
MD502618556cc9031be575a3ff80c252262
SHA151460a982c13f3fc3a74c633c45cf4b8b5e5cccb
SHA256c25b068be70ad7fc2ff83372115dcad6580401e7c1b849be41b514098eca1bfe
SHA512c4509867c954882e20487479a8b4595523f80de6701301443e65b460bf3606294a2852dbcd474622baae36466899aec050133eb95f3fd8348e6c79e96df52972
-
Filesize
1KB
MD583952d2b522ce8f0515f53f7dba0df1a
SHA104bb5f7d749c37b045c5495875d7e4ca22f8ec4e
SHA2568627d793725b23d08411b695b08b6d6be2a09c6c185806f3b2e927f623dd333f
SHA512215424e11b4c7ab25924611f77f228653f471e20a106c107ba78c731f23c3501646208675d72f50d3a60ac8e6ffe2e092e4ccf64b029ee5df80e31dcf559f08b
-
Filesize
13B
MD57b13c7f598cfc7a9f2253991cb954fc0
SHA1c5c7aa7151fd47f9f84ccf829607867f300db933
SHA256995e74212fd31644031df05a1d59ea20b39b80fb667991fe9a2cd90b97dc55d0
SHA512d8d036be8503c8568e7dcd80839c8daf50e654db77f6c187c45ec02a6c94c22a689cddd097171007c4d2aa5fa076ff5ecaa33f223ecf4bdff9ff4316248954b8
-
Filesize
1KB
MD5fa3b89029f4c153f3509b8329d8efd9b
SHA1a2b323c4092aab4f65fa4ee9f96a74e7e7c921c6
SHA256f7beddd2efd4594987ac5630d6bef737a3ea6b352e605447bb21b9945f5ca60e
SHA512898091fea350ebebe3ca45517b29fc5f2318e7ce1f021a28b089acbda3a2d4e7455c491f91ce4ef955f7ea0098dbacdbb5012a0afe71c5983d64384de58f15ef
-
Filesize
54B
MD5a8d62183034fdb9b252e461ccc01286b
SHA1a6b58f277e5e11c05f78a1c81d96f7ede2aad1c5
SHA25690eca1c330f256eb383b0b49595a418944dfe5d70a05edaf437c0030927edc34
SHA512996eddc0a276319bb2a4ae0721060a9c07ff1470ba640b53b325160518fc3bfe17a92495b6337ed7b80ca3a3db44fe6e1175038f0c999b738e677ab4533a5962
-
Filesize
1013B
MD5c7354121d8dacf2c447900fc1976352f
SHA1b7ba1b77e6914868d4b77aa03d0cb876fca4fb93
SHA2568edbf6b215cd82078d7c3e7274559dd7f6b3fed86ea80b365feb4b469e04847d
SHA5126bbeb05cd2988341d81bf7a61634d865f69de2eb00c902fdb54c40379b88be2d0c33ebfea224e6dce6a7895df2231ed9174bcf0b0646ee67840b3bd621af5a95
-
Filesize
16B
MD5e68fcf3bec751a474dba10ff5c1cda58
SHA1fb37c3cd28a64ded1505c4ba3d367083b49dfa57
SHA256703538b9536728e05dfcd4afda657460e06fcbd7931583fce33d82b75c50ad91
SHA51258de38f52d5d2b66af0756dc018a3f2140526f63931e41c641eebe0163bda6b58db96f8056ce53abc80d8b688e16ddbc9d6ee3a2332542862a828e9f63bee699
-
Filesize
1KB
MD52d3e6ad06887ebc71ac2431edfc113bd
SHA16f4a16ed9dea5f7f4e5d357085f5e19048242ba2
SHA25638525e76e950a08af6edf0b879a608d603563aa46ffaf7e2abaa190648edfa15
SHA512e132be2c57613e3d5faa417c20a234381f172acc08907ec5dbc88d698810bbdbefb7370676f185cbeabbf13732c85ea1e36012cfd9da9416fce3cbc06a1a8fa7
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
364KB
-
Filesize
212KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
2.2MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
408KB
-
Filesize
288KB
-
Filesize
132KB
-
Filesize
2.5MB
-
Filesize
2.3MB
-
Filesize
9.5MB
-
Filesize
2.1MB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
40KB
-
Filesize
172KB
-
Filesize
844KB