Overview

overview

10

Static

static

10

GTX Grabbe...er.exe

windows10-2004-x64

7

GTX Grabbe...er.exe

windows11-21h2-x64

7

Resubmissions

02/06/2026, 15:50

260602-tae1bahw2x10

06/05/2026, 12:44

260506-pygrlabs2v10

06/05/2026, 12:40

260506-pwmvtsa18s10

Analysis

  • user interaction
    yes
  • max time kernel
    245s
  • max time network
    164s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/05/2026, 12:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GTX Grabber/GTX Grabber.exe
  • Size 13.2MB
  • Sample260506-pygrlabs2v
  • SHA256 6b8fd61dd368291bc6f14ced7fd0530d7cb8f3b769ee1964798515a0b1d43864
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 42 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 36 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GTX Grabber\GTX Grabber.exe
    "C:\Users\Admin\AppData\Local\Temp\GTX Grabber\GTX Grabber.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\GTX Grabber\GTX Grabber.exe
      "C:\Users\Admin\AppData\Local\Temp\GTX Grabber\GTX Grabber.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\Crypto\Cipher\_raw_cbc.pyd
        • Size 12KB
        • SHA256 e804a6a7cbf50e7dd64fce306ee73bfd1920a14b071003b9f5dd744e46d489b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\Crypto\Cipher\_raw_cfb.pyd
        • Size 13KB
        • SHA256 b7e02112998b9821e2cb29bd016a5671a826fe1364f8cd6ef6bb1bc9f0651bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\Crypto\Cipher\_raw_ctr.pyd
        • Size 14KB
        • SHA256 5729a10903cc99482aeea54da09d391fac8d0c22e7939a566b70e3095b64318d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\Crypto\Cipher\_raw_ecb.pyd
        • Size 10KB
        • SHA256 67e06bd6dd08638dcb5e33100ae6fc3e8daf7ebbb1482b528e221e7535e2cba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\Crypto\Cipher\_raw_ofb.pyd
        • Size 12KB
        • SHA256 c93f76b8f2c03bddd2f89d7c46ae6e2b75a5638db515add01927b749d965c9c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\Crypto\Util\_strxor.pyd
        • Size 10KB
        • SHA256 560a6d183ce437b847bfb7b7d4a98f22ea72fb365fbc2ec73ddd1bd8be1c6e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_asyncio.pyd
        • Size 69KB
        • SHA256 f8305023f6ad81ddc7124b311e500a58914b05a9b072bf9a6d079ea0f6257793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_bz2.pyd
        • Size 82KB
        • SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_cffi_backend.cp312-win_amd64.pyd
        • Size 178KB
        • SHA256 d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_ctypes.pyd
        • Size 122KB
        • SHA256 543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_decimal.pyd
        • Size 247KB
        • SHA256 d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_hashlib.pyd
        • Size 64KB
        • SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_lzma.pyd
        • Size 155KB
        • SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_multiprocessing.pyd
        • Size 34KB
        • SHA256 5673b594e70d1fdaad3895fc8c3676252b7b675656fb88ef3410bc93bb0e7687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_overlapped.pyd
        • Size 54KB
        • SHA256 2e53cc1bfa6e10a4de7e1f4081c5b952746e2d4fa7f8b9929ad818ce20b2cc9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_queue.pyd
        • Size 31KB
        • SHA256 d43dca0e00c3c11329b68177e967cf5240495c4786f5afa76ac4f267c3a5cdb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_socket.pyd
        • Size 81KB
        • SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_sqlite3.pyd
        • Size 121KB
        • SHA256 f3ca1d6b1ab8bb8d6f35a24fc602165e6995e371226e98ffeeed2eeec253c9df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_ssl.pyd
        • Size 173KB
        • SHA256 2b6f1b1ac47cb7878b62e8d6bb587052f86ca8145b05a261e855305b9ca3d36c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_uuid.pyd
        • Size 24KB
        • SHA256 d462f34aca50d1f37b9ea03036c881ee4452e1fd37e1b303cd6daaecc53e260e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\_wmi.pyd
        • Size 35KB
        • SHA256 0342916a60a7b39bbd5753d85e1c12a4d6f990499753d467018b21cefa49cf32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\base_library.zip
        • Size 1.3MB
        • SHA256 eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\charset_normalizer\md.cp312-win_amd64.pyd
        • Size 10KB
        • SHA256 ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
        • Size 120KB
        • SHA256 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\libssl-3.dll
        • Size 771KB
        • SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\pyexpat.pyd
        • Size 194KB
        • SHA256 cdc09fbae2f103196215facd50d108be3eff60c8ee5795dcc80bf57a0f120cdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\python312.dll
        • Size 6.7MB
        • SHA256 0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\select.pyd
        • Size 29KB
        • SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\sqlite3.dll
        • Size 1.4MB
        • SHA256 17d547994008f1626be2877497912687cb3ebd9a407396804310fd12c85aead4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20962\unicodedata.pyd
        • Size 1.1MB
        • SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download