Analysis
-
max time kernel
297s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 15:25
Behavioral task
behavioral1
Sample
PyGrabber.BETA.rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PyGrabber.BETA.rar
Resource
win11-20240611-en
General
-
Target
PyGrabber.BETA.rar
-
Size
20KB
-
MD5
5a1cec2179fcc1a5d8abe6dd854f024f
-
SHA1
fcddfca666c9c109b3e6441f526fdbe9d1308950
-
SHA256
060eeba1a6af6ae88083fd6b7756b7e5892e89e94dd0317757649584386b1b2d
-
SHA512
e92a7941052bd83ee9d7689d643e78a6857e735f05ce449a9faad858b6076f69ca3387472c452455ea2b2c10c4ec720a713433d05677e5f07dd9809e79704a13
-
SSDEEP
384:4bL4cnRhYxtBeVL9hDrnMD9oeATHi88nPzuZZRR/Slv8Gz4nT7aFdH4zQM:qM18VfDbvF8PzubRR/36467fM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2712 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2712 vlc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
vlc.exepid process 2712 vlc.exe 2712 vlc.exe 2712 vlc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
vlc.exepid process 2712 vlc.exe 2712 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2712 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1472 wrote to memory of 2024 1472 cmd.exe rundll32.exe PID 1472 wrote to memory of 2024 1472 cmd.exe rundll32.exe PID 1472 wrote to memory of 2024 1472 cmd.exe rundll32.exe PID 2024 wrote to memory of 2712 2024 rundll32.exe vlc.exe PID 2024 wrote to memory of 2712 2024 rundll32.exe vlc.exe PID 2024 wrote to memory of 2712 2024 rundll32.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PyGrabber.BETA.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PyGrabber.BETA.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\PyGrabber.BETA.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2712-25-0x000007FEF7190000-0x000007FEF71C4000-memory.dmpFilesize
208KB
-
memory/2712-24-0x000000013F990000-0x000000013FA88000-memory.dmpFilesize
992KB
-
memory/2712-27-0x000007FEFB3C0000-0x000007FEFB3D8000-memory.dmpFilesize
96KB
-
memory/2712-28-0x000007FEF7150000-0x000007FEF7167000-memory.dmpFilesize
92KB
-
memory/2712-33-0x000007FEF6180000-0x000007FEF6191000-memory.dmpFilesize
68KB
-
memory/2712-32-0x000007FEF65C0000-0x000007FEF65DD000-memory.dmpFilesize
116KB
-
memory/2712-31-0x000007FEF65E0000-0x000007FEF65F1000-memory.dmpFilesize
68KB
-
memory/2712-30-0x000007FEF6600000-0x000007FEF6617000-memory.dmpFilesize
92KB
-
memory/2712-29-0x000007FEF6760000-0x000007FEF6771000-memory.dmpFilesize
68KB
-
memory/2712-26-0x000007FEF5890000-0x000007FEF5B44000-memory.dmpFilesize
2.7MB
-
memory/2712-34-0x000007FEF5690000-0x000007FEF5890000-memory.dmpFilesize
2.0MB
-
memory/2712-36-0x000007FEF6140000-0x000007FEF617F000-memory.dmpFilesize
252KB
-
memory/2712-37-0x000007FEF60C0000-0x000007FEF60E1000-memory.dmpFilesize
132KB
-
memory/2712-38-0x000007FEF60A0000-0x000007FEF60B8000-memory.dmpFilesize
96KB
-
memory/2712-39-0x000007FEF6080000-0x000007FEF6091000-memory.dmpFilesize
68KB
-
memory/2712-40-0x000007FEF6060000-0x000007FEF6071000-memory.dmpFilesize
68KB
-
memory/2712-41-0x000007FEF6040000-0x000007FEF6051000-memory.dmpFilesize
68KB
-
memory/2712-47-0x000007FEF4570000-0x000007FEF45DF000-memory.dmpFilesize
444KB
-
memory/2712-42-0x000007FEF5FB0000-0x000007FEF5FCB000-memory.dmpFilesize
108KB
-
memory/2712-43-0x000007FEF5F90000-0x000007FEF5FA1000-memory.dmpFilesize
68KB
-
memory/2712-44-0x000007FEF5F70000-0x000007FEF5F88000-memory.dmpFilesize
96KB
-
memory/2712-55-0x000007FEF4400000-0x000007FEF4412000-memory.dmpFilesize
72KB
-
memory/2712-35-0x000007FEF45E0000-0x000007FEF568B000-memory.dmpFilesize
16.7MB
-
memory/2712-54-0x000007FEF4420000-0x000007FEF4431000-memory.dmpFilesize
68KB
-
memory/2712-53-0x000007FEF4440000-0x000007FEF4463000-memory.dmpFilesize
140KB
-
memory/2712-52-0x000007FEF4470000-0x000007FEF4487000-memory.dmpFilesize
92KB
-
memory/2712-51-0x000007FEF4490000-0x000007FEF44B4000-memory.dmpFilesize
144KB
-
memory/2712-50-0x000007FEF44C0000-0x000007FEF44E8000-memory.dmpFilesize
160KB
-
memory/2712-49-0x000007FEF44F0000-0x000007FEF4546000-memory.dmpFilesize
344KB
-
memory/2712-48-0x000007FEF4550000-0x000007FEF4561000-memory.dmpFilesize
68KB
-
memory/2712-46-0x000007FEF5ED0000-0x000007FEF5F37000-memory.dmpFilesize
412KB
-
memory/2712-45-0x000007FEF5F40000-0x000007FEF5F70000-memory.dmpFilesize
192KB