Analysis
-
max time kernel
450s -
max time network
483s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
26/03/2025, 04:41
Behavioral task
behavioral1
Sample
EXTRACTORZIP.exe
Resource
win11-20250313-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
discord_token_grabber.pyc
Resource
win11-20250313-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral3
Sample
get_cookies.pyc
Resource
win11-20250313-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
misc.pyc
Resource
win11-20250313-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
passwords_grabber.pyc
Resource
win11-20250314-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
source_prepared.pyc
Resource
win11-20250313-en
windows11-21h2-x64
3 signatures
900 seconds
General
-
Target
discord_token_grabber.pyc
-
Size
16KB
-
MD5
924ef065a5167d44170ac81a60cc6fbe
-
SHA1
ebfa171438758dd9810369d3077f618bfab5bc09
-
SHA256
78a36fae762432c89f4c0b185e5c227144817199dbde90d16749c6bfc0fb1dd1
-
SHA512
15a2144fe6e0e081856fd875bcbb239a83da115dce2cda1924f71cfc401f13f681d5047cb80b40cdcdcb617c12d9c12f7bfdc15d38177ace8685c59bb631afdc
-
SSDEEP
192:bIqqTmuEWauge+M6DA8AYv++JDcNQshU8En5W4NXOYd/G7XW:+9avP588A+DDWRm5FOUG7XW
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\.pyc\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\峅˚ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\縀䆁 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\pyc_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\.pyc OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\촤聃᐀耀࠰峅˚\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\࠰峅˚ OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\讉翾 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\讉翾\ = "pyc_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\縀䆁\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\pyc_auto_file\shell\Read\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\pyc_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\峅˚\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\촤聃᐀耀࠰峅˚ OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\࠰峅˚\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\pyc_auto_file\shell\Read OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3316 OpenWith.exe -
Suspicious use of SetWindowsHookEx 27 IoCs
pid Process 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 3316 OpenWith.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe 4480 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 4480 3316 OpenWith.exe 85 PID 3316 wrote to memory of 4480 3316 OpenWith.exe 85 PID 3316 wrote to memory of 4480 3316 OpenWith.exe 85 PID 4480 wrote to memory of 2656 4480 AcroRd32.exe 89 PID 4480 wrote to memory of 2656 4480 AcroRd32.exe 89 PID 4480 wrote to memory of 2656 4480 AcroRd32.exe 89 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 3840 2656 RdrCEF.exe 90 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91 PID 2656 wrote to memory of 4440 2656 RdrCEF.exe 91
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc1⤵
- Modifies registry class
PID:4616
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C362F2C3DAA0B640749EDADDEBB6CE42 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3840
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=69105ABE49AE8691D6EC34897A79E017 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=69105ABE49AE8691D6EC34897A79E017 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4440
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CCDE6898363AE5088793E99AB473C4F8 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:772
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=402C88854F74F2DD4D3109A2ED2E4623 --mojo-platform-channel-handle=1880 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4064
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CF43BD4AA84D8267E760AD817F51CDCF --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:5156
-
-
-