b6bf856f34b8bb5db46680c7cfed3ca4a8fbd0b170c9640a17242ca3f2833563

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord_token_grabber.pyc
Size

8KB
MD5

6b2aaa23f9b67dca5fa0efd9d96e9060
SHA1

07293442aa33cbc0afc1b69af287b1fede2e9a70
SHA256

f49ba791814001b3d4101685bfebb635cdaf3103407a08171bb5d6bbe3e79c77
SHA512

bcd7b41e7758b30954b0e24db5d53d3d904b6c4b9a5105bd33e5dddddb310614cc09a028d0cd8ccb6a272ce5eba0e9142a1cc36ec848b54fb99b695752b5e20d
SSDEEP

192:ESB7osP1MJaugwXaafNqaclHJLOq3ZJFD/b8xjJzdJv:TP1iavwTqacyq35D0Fnv

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2804	AcroRd32.exe
2804	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2252	1304	cmd.exe	31
PID 1304 wrote to memory of 2252	1304	cmd.exe	31
PID 1304 wrote to memory of 2252	1304	cmd.exe	31
PID 2252 wrote to memory of 2804	2252	rundll32.exe	32
PID 2252 wrote to memory of 2804	2252	rundll32.exe	32
PID 2252 wrote to memory of 2804	2252	rundll32.exe	32
PID 2252 wrote to memory of 2804	2252	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
175aac3ce16237cdc9cfb27385ef9dbb

SHA1
606878654a446143f84bc2c8c75c5e2bd3fc73e6

SHA256
1599131dd83a30b7c03436b77db37653824125123151fe978b2502647ea8a131

SHA512
0a1b47b05742f7a692594e525fe9d78dc22b4da0b6cafcf2c2438a125bb4f120bfb6c5394cb98f777d89e034d786553b0109d7b418a93042e795d759a75aaec6

Download Submit