File name: | Reborn.exe |
Full analysis: | https://app.any.run/tasks/32a291bf-31c0-41dd-b7c9-623c215ba46e |
Verdict: | Malicious activity |
Threats: | Blank Grabber is an infostealer written in Python. It is designed to steal a wide array of data, such as browser login credentials, crypto wallets, Telegram sessions, and Discord tokens. It is an open-source malware, with its code available on GitHub and regularly receiving updates. Blank Grabber builder’s simple interface lets threat actors even with basic skills to deploy it and conduct attacks. |
Analysis date: | January 10, 2025, 19:44:18 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
MD5: | B89D8FD23DE8F490846E3880C5D7B60E |
SHA1: | 090D6A02D55C1F10643452B7D906A37A8FC75006 |
SHA256: | 95EB2F3F29315DD236021E45E665AF1D7B7030774EFB8BD9FE08F83B9512EFC7 |
SSDEEP: | 98304:eJ3udFZS715R//GUPVpYSTDtIAJQ1knyuyax71czfqqQVH68DcDo0nkPle2dxrJn:WSotkUm44a+WzNC6 |
.exe | | | Win64 Executable (generic) (87.3) |
---|---|---|
.exe | | | Generic Win/DOS Executable (6.3) |
.exe | | | DOS Executable Generic (6.3) |
ProductVersion: | 10.0.26100.2161 |
---|---|
ProductName: | Microsoft® Windows® Operating System |
OriginalFileName: | EdpNotify.exe |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
InternalName: | EdpNotify.exe |
FileVersion: | 10.0.26100.2161 (WinBuild.160101.0800) |
FileDescription: | Microsoft Enterpise Data Protection |
CompanyName: | Microsoft Corporation |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 10.0.26100.2161 |
FileVersionNumber: | 10.0.26100.2161 |
Subsystem: | Windows GUI |
SubsystemVersion: | 6 |
ImageVersion: | - |
OSVersion: | 6 |
EntryPoint: | 0xce20 |
UninitializedDataSize: | - |
InitializedDataSize: | 94208 |
CodeSize: | 172032 |
LinkerVersion: | 14.41 |
PEType: | PE32+ |
ImageFileCharacteristics: | Executable, Large address aware |
TimeStamp: | 2024:12:10 18:45:15+00:00 |
MachineType: | AMD AMD64 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6492 | "C:\Users\admin\AppData\Local\Temp\Reborn.exe" | C:\Users\admin\AppData\Local\Temp\Reborn.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Enterpise Data Protection Exit code: 0 Version: 10.0.26100.2161 (WinBuild.160101.0800) Modules
| |||||||||||||||
6516 | "C:\Users\admin\AppData\Local\Temp\Reborn.exe" | C:\Users\admin\AppData\Local\Temp\Reborn.exe | — | Reborn.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Enterpise Data Protection Exit code: 0 Version: 10.0.26100.2161 (WinBuild.160101.0800) Modules
| |||||||||||||||
6816 | "C:\Users\admin\AppData\Local\Temp\Reborn.exe" C:\Users\admin\AppData\Local\Temp\Reborn.exe | C:\Users\admin\AppData\Local\Temp\Reborn.exe | Reborn.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Enterpise Data Protection Exit code: 0 Version: 10.0.26100.2161 (WinBuild.160101.0800) Modules
| |||||||||||||||
6864 | "C:\Users\admin\AppData\Local\Temp\Reborn.exe" C:\Users\admin\AppData\Local\Temp\Reborn.exe | C:\Users\admin\AppData\Local\Temp\Reborn.exe | Reborn.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Enterpise Data Protection Exit code: 0 Version: 10.0.26100.2161 (WinBuild.160101.0800) Modules
| |||||||||||||||
6892 | C:\WINDOWS\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Local\Temp\Reborn.exe'" | C:\Windows\System32\cmd.exe | — | Reborn.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6900 | C:\WINDOWS\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" | C:\Windows\System32\cmd.exe | — | Reborn.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6908 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6920 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6928 | C:\WINDOWS\system32\cmd.exe /c "tasklist /FO LIST" | C:\Windows\System32\cmd.exe | — | Reborn.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6964 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\_ctypes.pyd | executable | |
MD5:B6262F9FBDCA0FE77E96A9EED25E312F | SHA256:1C0F9C3BDC53C2B24D5480858377883A002EB2EBB57769D30649868BFB191998 | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\VCRUNTIME140.dll | executable | |
MD5:862F820C3251E4CA6FC0AC00E4092239 | SHA256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153 | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\_hashlib.pyd | executable | |
MD5:0B214888FAC908AD036B84E5674539E2 | SHA256:A9F24AD79A3D2A71B07F93CD56FC71958109F0D1B79EEBF703C9ED3AC76525FF | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\_bz2.pyd | executable | |
MD5:E1B31198135E45800ED416BD05F8362E | SHA256:43F812A27AF7E3C6876DB1005E0F4FB04DB6AF83A389E5F00B3F25A66F26EB80 | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\_decimal.pyd | executable | |
MD5:9CFB6D9624033002BC19435BAE7FF838 | SHA256:41B0B60FE2AA2B63C93D3CE9AB69247D440738EDB4805F18DB3D1DAA6BB3EBFF | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\select.pyd | executable | |
MD5:933DA5361079FC8457E19ADAB86FF4E0 | SHA256:ADFDF84FF4639F8A921B78A2EFCE1B89265DF2B512DF05CE2859FC3CC6E33EFF | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\rar.exe | executable | |
MD5:9C223575AE5B9544BC3D69AC6364F75E | SHA256:90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213 | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\_sqlite3.pyd | executable | |
MD5:F018B2C125AA1ECC120F80180402B90B | SHA256:67A887D3E45C8836F8466DC32B1BB8D64C438F24914F9410BC52B02003712443 | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\_queue.pyd | executable | |
MD5:766820215F82330F67E248F21668F0B3 | SHA256:EF361936929B70EF85E070ED89E55CBDA7837441ACAFEEA7EF7A0BB66ADDEEC6 | |||
6492 | Reborn.exe | C:\Users\admin\AppData\Local\Temp\_MEI64922\libssl-3.dll | executable | |
MD5:B2E766F5CF6F9D4DCBE8537BC5BDED2F | SHA256:3CC6828E7047C6A7EFF517AA434403EA42128C8595BF44126765B38200B87CE4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6864 | Reborn.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/?fields=225545 | unknown | — | — | shared |
6272 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6864 | Reborn.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | shared |
5780 | svchost.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5780 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3208 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
3208 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4188 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5780 | svchost.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5780 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 20.190.159.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 104.126.37.146:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
blank-juxw0.in |
| unknown |
ip-api.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
— | — | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
— | — | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
— | — | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
— | — | A Network Trojan was detected | STEALER [ANY.RUN] BlankGrabber (SkochGrabber) Generic External IP Check |