Analysis date (UTC): 13 November 2024, 21:38Analysis environment: Windows 10 Pro, build 19045, x64

https://tria.ge/samples/241113-1cekwszdpk/sample.zip

MD5:6C540CE80BDF4BB93EB17C340D54EB73

SHA1:CEA6480C244C4A5554B61F3E7F61021078E9FAAF

SHA256:386BD9E0A85E64667FC93479A037778874CB25FFA733A7C99B76B8DD29B9AD48

Analysis result

Threat level:Malicious activity

Tags:

pythondiscordevasionpyinstallerims-apigeneric

Full analysis:Analysis https://tria.ge/samples/241113-1cekwszdpk/sample.zip Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Uses Task Scheduler to autorun other applications

cmd.exe (PID: 4088)
cmd.exe (PID: 6684)

SUSPICIOUS

Process drops legitimate windows executable

extractmytoken.exe (PID: 7156)
extractmytoken.exe (PID: 7200)
extractmytoken.exe (PID: 3732)

Process drops python dynamic module

extractmytoken.exe (PID: 7156)
extractmytoken.exe (PID: 3732)
extractmytoken.exe (PID: 7200)

Executable content was dropped or overwritten

extractmytoken.exe (PID: 7156)
extractmytoken.exe (PID: 7200)
extractmytoken.exe (PID: 3732)

The process drops C-runtime libraries

extractmytoken.exe (PID: 7156)
extractmytoken.exe (PID: 3732)
extractmytoken.exe (PID: 7200)

Loads Python modules

extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 6440)
extractmytoken.exe (PID: 6532)

Application launched itself

extractmytoken.exe (PID: 7156)
extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 7200)
extractmytoken.exe (PID: 3732)

Starts CMD.EXE for commands execution

extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 6532)
extractmytoken.exe (PID: 6440)

Uses WMIC.EXE to obtain local storage devices information

cmd.exe (PID: 6248)
cmd.exe (PID: 4312)
cmd.exe (PID: 6300)
cmd.exe (PID: 3900)
cmd.exe (PID: 1172)
cmd.exe (PID: 2796)
cmd.exe (PID: 8048)
cmd.exe (PID: 1200)
cmd.exe (PID: 7040)

Possible usage of Discord/Telegram API has been detected (YARA)

extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 6440)

There is functionality for taking screenshot (YARA)

extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 6440)

Checks for external IP

svchost.exe (PID: 2172)
extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 6532)
extractmytoken.exe (PID: 6440)

Uses NETSH.EXE to obtain data on the network

cmd.exe (PID: 6828)
cmd.exe (PID: 4904)
cmd.exe (PID: 6976)

INFO

Application launched itself

msedge.exe (PID: 6584)
msedge.exe (PID: 916)

Reads Microsoft Office registry keys

msedge.exe (PID: 6584)

Checks supported languages

identity_helper.exe (PID: 7520)
identity_helper.exe (PID: 6232)
extractmytoken.exe (PID: 7156)

The process uses the downloaded file

msedge.exe (PID: 4448)
msedge.exe (PID: 6584)

Reads the computer name

identity_helper.exe (PID: 7520)
identity_helper.exe (PID: 6232)
extractmytoken.exe (PID: 7156)

Reads Environment values

identity_helper.exe (PID: 6232)
identity_helper.exe (PID: 7520)

Manual execution by a user

extractmytoken.exe (PID: 7156)
extractmytoken.exe (PID: 7200)

PyInstaller has been detected (YARA)

extractmytoken.exe (PID: 7156)
extractmytoken.exe (PID: 3732)
extractmytoken.exe (PID: 7200)
extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 6440)

Attempting to use instant messaging service

extractmytoken.exe (PID: 6440)
extractmytoken.exe (PID: 7264)
extractmytoken.exe (PID: 6532)

Executable content was dropped or overwritten

msedge.exe (PID: 7576)

Threats

PID	Process	Class	Message
2172	svchost.exe	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discord .com)
7264	extractmytoken.exe	Misc activity	ET INFO Observed Discord Domain (discord .com in TLS SNI)
2172	svchost.exe	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2172	svchost.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
7264	extractmytoken.exe	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
7264	extractmytoken.exe	Device Retrieving External IP Address Detected	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
7264	extractmytoken.exe	Misc activity	ET INFO Observed Discord Domain (discord .com in TLS SNI)
6440	extractmytoken.exe	Misc activity	ET INFO Observed Discord Domain (discord .com in TLS SNI)
6532	extractmytoken.exe	Misc activity	ET INFO Observed Discord Domain (discord .com in TLS SNI)
6440	extractmytoken.exe	Device Retrieving External IP Address Detected	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)

Rows per page