Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
16/07/2023, 13:27
General
-
Target
Discord.AIO.exe
-
Size
6.5MB
-
MD5
7adc6022bb09db5e263fb294aaab2566
-
SHA1
77746a413c35573521c14eba036a2da5da68526a
-
SHA256
54bb1a394197df666003cd83a607b364b373c32df999c51f3c14bb830fc776ee
-
SHA512
21922589a3dc6fd2ccf4545dceb15249ca8882d946d9a29a90248dec55ed41b719d9d835381e0115a10d58957dbbc7ac3a277c2e1e88f398c672bed8e249a11a
-
SSDEEP
98304:27w0WYwOYA4vWVU4fgcmnH3EPIL6yFs9u/FpboNe7mZD7JOu9mq2Jo2N/03FIgcG:ts4vkmXas+6cOGR2JFNmWZCZ
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord.AIO.exe"C:\Users\Admin\AppData\Local\Temp\Discord.AIO.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
943KB
MD52ff7acfa80647ee46cc3c0e446327108
SHA1c994820d03af722c244b046d1ee0967f1b5bc478
SHA25608f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d
SHA51250a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB