Analysis
- max time kernel
150s - max time network
162s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 16:19
General
- Target Lethal Grabber/LethalGrabber.exe
- Size 85.2MB
- Sample260709-tssdcses4t
- SHA256 83f6b090aba405321b99689223d9e24ddecd275ccc57bac3cbb3b3372be70e2b
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 62 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lethal Grabber\LethalGrabber.exe"C:\Users\Admin\AppData\Local\Temp\Lethal Grabber\LethalGrabber.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAZwB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAbQByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAcwBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHcAYgBnACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\stager.exe"C:\Users\Admin\AppData\Local\Temp\stager.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\stager.exe"C:\Users\Admin\AppData\Local\Temp\stager.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\SysHealthStrayX64.exe"C:\Users\Admin\AppData\Local\Temp\SysHealthStrayX64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SysHealthStrayX64.exe"C:\Users\Admin\AppData\Local\Temp\SysHealthStrayX64.exe"3⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Modifies registry class
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Defense Evasion
Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python314.dll
ucrtbase.dll
unicodedata.pyd
VCRUNTIME140_1.dll
_queue.pyd
_wmi.pyd
base_library.zip
python3.DLL
stager.exe
stager_debug.txt
memory/2088-174-0x0000000007BB0000-0x000000000822C000-memory.dmp
memory/2088-177-0x00000000077F0000-0x0000000007886000-memory.dmp
memory/2088-99-0x0000000005E70000-0x0000000005E8E000-memory.dmp
memory/2088-168-0x0000000007210000-0x0000000007246000-memory.dmp
memory/2088-172-0x00000000071F0000-0x0000000007210000-memory.dmp
memory/2088-169-0x00000000705A0000-0x00000000705EC000-memory.dmp
memory/2088-173-0x0000000007450000-0x00000000074F3000-memory.dmp
memory/2088-175-0x0000000007570000-0x000000000758A000-memory.dmp
memory/2088-6-0x0000000002D00000-0x0000000002D36000-memory.dmp
memory/2088-9-0x0000000005520000-0x0000000005B6A000-memory.dmp
memory/2088-176-0x00000000075F0000-0x00000000075FA000-memory.dmp
memory/2088-73-0x0000000005C40000-0x0000000005CA6000-memory.dmp
memory/2088-72-0x0000000005BA0000-0x0000000005BC2000-memory.dmp
memory/2088-102-0x0000000005EC0000-0x0000000005F0C000-memory.dmp
memory/2088-79-0x0000000005CB0000-0x0000000005D16000-memory.dmp
memory/2088-85-0x0000000005F20000-0x000000000627B000-memory.dmp
memory/4528-367-0x0000000070D40000-0x00000000730BE000-memory.dmp
memory/4528-368-0x0000000070D40000-0x00000000730BE000-memory.dmp