| File name: | Discord Token Generator.exe |
| Full analysis: | https://app.any.run/tasks/1fb8040f-a592-4756-ac0c-05f19f8d8552 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | May 15, 2025, 22:31:30 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (console) Intel 80386, for MS Windows, 6 sections |
| MD5: | 8113A813F30E23B7DA6080ABA9081ABC |
| SHA1: | CC3D6E5D8494B10E08608CAEED84BC85AA5F9C7D |
| SHA256: | 90F6A8DA8C569ED6408F14AF4B6657FBD07B920C92B82AFE66D0073FF699865E |
| SSDEEP: | 393216:X9hbkkP1dwCteW6EW3imtykJQlpYKoV3Wj3+tII:X9hbr19te3rEU0ToV3Wj4 |
MALICIOUS
Actions looks like stealing of personal data
- Discord Token Generator.exe (PID: 7884)
Steals credentials from Web Browsers
- Discord Token Generator.exe (PID: 7884)
SUSPICIOUS
Process drops python dynamic module
- Discord Token Generator.exe (PID: 7352)
Executable content was dropped or overwritten
- Discord Token Generator.exe (PID: 7352)
Process drops legitimate windows executable
- Discord Token Generator.exe (PID: 7352)
The process drops C-runtime libraries
- Discord Token Generator.exe (PID: 7352)
Application launched itself
- Discord Token Generator.exe (PID: 7352)
Loads Python modules
- Discord Token Generator.exe (PID: 7884)
Starts CMD.EXE for commands execution
- Discord Token Generator.exe (PID: 7884)
Checks for external IP
- Discord Token Generator.exe (PID: 7884)
INFO
Checks supported languages
- Discord Token Generator.exe (PID: 7352)
- Discord Token Generator.exe (PID: 7884)
Reads the computer name
- Discord Token Generator.exe (PID: 7352)
- Discord Token Generator.exe (PID: 7884)
The sample compiled with english language support
- Discord Token Generator.exe (PID: 7352)
Create files in a temporary directory
- Discord Token Generator.exe (PID: 7352)
- Discord Token Generator.exe (PID: 7884)
PyInstaller has been detected (YARA)
- Discord Token Generator.exe (PID: 7352)
Reads the machine GUID from the registry
- Discord Token Generator.exe (PID: 7884)
Checks proxy server information
- Discord Token Generator.exe (PID: 7884)
Creates files or folders in the user directory
- Discord Token Generator.exe (PID: 7884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | InstallShield setup (54.3) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (34.8) |
| .exe | | | Win32 Executable (generic) (5.6) |
| .exe | | | Generic Win/DOS Executable (2.5) |
| .exe | | | DOS Executable Generic (2.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:08:08 12:29:54+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 128000 |
| InitializedDataSize: | 187904 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x781a |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows command line |
Total processes
126
Monitored processes
4
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 7352 | "C:\Users\admin\AppData\Local\Temp\Discord Token Generator.exe" | C:\Users\admin\AppData\Local\Temp\Discord Token Generator.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
| 7360 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Discord Token Generator.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7884 | "C:\Users\admin\AppData\Local\Temp\Discord Token Generator.exe" | C:\Users\admin\AppData\Local\Temp\Discord Token Generator.exe | Discord Token Generator.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
| 7904 | C:\WINDOWS\system32\cmd.exe /c title ThisEsteb - Discord Tokens Generator - 0 Tokens | C:\Windows\SysWOW64\cmd.exe | — | Discord Token Generator.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
6 124
Read events
6 124
Write events
0
Delete events
0
Modification events
Executable files
75
Suspicious files
6
Text files
917
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_raw_blowfish.cp38-win32.pyd | executable | |
MD5:9B219BBC67D899C608718FB267B9E786 | SHA256:90E8448B0BAD3AC2AF599488D9BA4E43C93FF83193B3E8F37D43C8F2D13A63EE | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_raw_cast.cp38-win32.pyd | executable | |
MD5:6BFCD7F209C7D3E2168EEC0354E90B51 | SHA256:F526A4F1EAD0C2FAC0565830731A28B8B006CECEE809BDAFAD3A39A17A26BC39 | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_raw_arc2.cp38-win32.pyd | executable | |
MD5:81F04220BF3B7B779BFAD8C0FE2C38DE | SHA256:6980DA95392C9B334B41757C0D19A95B8CABFA2608E64ADBA0838A852A2CB5D6 | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_chacha20.cp38-win32.pyd | executable | |
MD5:100BE873039DF2C8A2DA4F9554BAEEA3 | SHA256:4861F5CA729112D56C4CD6B3301AACB2803DAF6371BD3992D4339E4BAE968AF5 | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_Salsa20.cp38-win32.pyd | executable | |
MD5:D60C062852DDF6117AB9764DEC4BC50D | SHA256:9A77AB2C8BFEE75F572B22BFF1ACE6A0E96D6C2969F38164B541B4266A35773B | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_raw_aesni.cp38-win32.pyd | executable | |
MD5:5D5C1BC6C74C7C83F27BA9C8C6638863 | SHA256:53D8A935D07BC307692EB1AF1369C62E7AA051224178344270C6A2003394B67B | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_ARC4.cp38-win32.pyd | executable | |
MD5:FC1EF85BCF1D44DB6D32192EDAF931F4 | SHA256:DB4284303E94A682101C2C5FB73DD35405EB04AA7392E34429263547CF5B83B2 | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_raw_des.cp38-win32.pyd | executable | |
MD5:302449E8BAA408E6A6E218B324383D33 | SHA256:F6DDF25D9A4A3EB86293BB6E849E515D4BEEA49908E281AE1B286CAAAD514E7C | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_raw_aes.cp38-win32.pyd | executable | |
MD5:662BF265439BB6C3A009EE41DBC4F6E4 | SHA256:E73E54B991A1D5BDDD2E8497AEA1598D2A14602D3A12108F84FB685C34EFC239 | |||
| 7352 | Discord Token Generator.exe | C:\Users\admin\AppData\Local\Temp\_MEI73522\Crypto\Cipher\_raw_cbc.cp38-win32.pyd | executable | |
MD5:C9CD927AB77F219B74C29C9CED9D4A87 | SHA256:CB0667A3366AB483055376A94BCC551545333DEF8461DB49EB18559AD4473855 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
14
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7712 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7712 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
— | — | 23.219.150.101:80 | www.microsoft.com | AKAMAI-AS | CL | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.72:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
7712 | SIHClient.exe | 4.175.87.197:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
api.ipify.org |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
7884 | Discord Token Generator.exe | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |
7884 | Discord Token Generator.exe | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |