308a444777e8653c064291d5fd0d64704b8897bc46996ca1ddc42e5f282f7bb6

Analysis

max time kernel
837s
max time network
839s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/12/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord_token_grabber.pyc
Size

8KB
MD5

6b2aaa23f9b67dca5fa0efd9d96e9060
SHA1

07293442aa33cbc0afc1b69af287b1fede2e9a70
SHA256

f49ba791814001b3d4101685bfebb635cdaf3103407a08171bb5d6bbe3e79c77
SHA512

bcd7b41e7758b30954b0e24db5d53d3d904b6c4b9a5105bd33e5dddddb310614cc09a028d0cd8ccb6a272ce5eba0e9142a1cc36ec848b54fb99b695752b5e20d
SSDEEP

192:ESB7osP1MJaugwXaafNqaclHJLOq3ZJFD/b8xjJzdJv:TP1iavwTqacyq35D0Fnv

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1892	2080	cmd.exe	31
PID 2080 wrote to memory of 1892	2080	cmd.exe	31
PID 2080 wrote to memory of 1892	2080	cmd.exe	31
PID 1892 wrote to memory of 2724	1892	rundll32.exe	33
PID 1892 wrote to memory of 2724	1892	rundll32.exe	33
PID 1892 wrote to memory of 2724	1892	rundll32.exe	33
PID 1892 wrote to memory of 2724	1892	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cee69fcc3545e7ff92e64c73ac874320

SHA1
2c18d6be3e5d0c6bc17b73dbec1cd0601fc3c31c

SHA256
b2189aaac1006da32b72fc5f8c343bfec1f2ca568c25959fa3e995b8fa92a481

SHA512
c8011f09947e7c9a4c8da8bfccd70506c8b5a8e4fd93a0e7e728372480a322afef24ae8aca63a346a38df5e2b34b600d3c8623f1fc3c46ae3dc8a3e374693a10

Download Submit