e687b9d26149f7320a82e2dde3b044945f1ad5d12968bdc5c4b976602ef9d175

Submit
Reports

Overview

overview

Static

static

discord-reg.zip

windows7-x64

discord-reg.zip

windows10-2004-x64

discord-re...pi.dll

windows7-x64

discord-re...pi.dll

windows10-2004-x64

discord-re...dme.js

windows7-x64

discord-re...dme.js

windows10-2004-x64

discord-re...dex.js

windows7-x64

discord-re...dex.js

windows10-2004-x64

discord-re...und.js

windows7-x64

discord-re...und.js

windows10-2004-x64

discord-re...dex.js

windows7-x64

discord-re...dex.js

windows10-2004-x64

discord-re...und.js

windows7-x64

discord-re...und.js

windows10-2004-x64

discord-re...dex.js

windows7-x64

discord-re...dex.js

windows10-2004-x64

discord-re...DME.js

windows7-x64

discord-re...DME.js

windows10-2004-x64

discord-re...dex.js

windows7-x64

discord-re...dex.js

windows10-2004-x64

discord-re...DME.js

windows7-x64

discord-re...DME.js

windows10-2004-x64

discord-re...dex.js

windows7-x64

discord-re...dex.js

windows10-2004-x64

discord-re...dme.js

windows7-x64

discord-re...dme.js

windows10-2004-x64

discord-re...dex.js

windows7-x64

discord-re...dex.js

windows10-2004-x64

discord-re...DME.js

windows7-x64

discord-re...DME.js

windows10-2004-x64

discord-re...DME.js

windows7-x64

discord-re...DME.js

windows10-2004-x64

Analysis

max time kernel
1564s
max time network
1570s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23-09-2023 14:30

Sharing

Copy URL

Twitter E-mail

Static task

static1

snakebot snakebot

3 signatures

Behavioral task

behavioral1

Sample

discord-reg.zip

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral2

Sample

discord-reg.zip

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral3

Sample

discord-reg/bypass/browser/node_modules/bufferutil/prebuilds/win32-ia32/node.napi.dll

Resource

win7-20230831-en

windows7-x64

1 signatures

1800 seconds

Behavioral task

behavioral4

Sample

discord-reg/bypass/browser/node_modules/bufferutil/prebuilds/win32-ia32/node.napi.dll

Resource

win10v2004-20230915-en

windows10-2004-x64

3 signatures

1800 seconds

Behavioral task

behavioral5

Sample

discord-reg/bypass/browser/node_modules/bytes/Readme.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral6

Sample

discord-reg/bypass/browser/node_modules/bytes/Readme.js

Resource

win10v2004-20230915-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral7

Sample

discord-reg/bypass/browser/node_modules/bytes/index.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral8

Sample

discord-reg/bypass/browser/node_modules/bytes/index.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral9

Sample

discord-reg/bypass/browser/node_modules/call-bind/callBound.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral10

Sample

discord-reg/bypass/browser/node_modules/call-bind/callBound.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral11

Sample

discord-reg/bypass/browser/node_modules/call-bind/index.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral12

Sample

discord-reg/bypass/browser/node_modules/call-bind/index.js

Resource

win10v2004-20230915-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral13

Sample

discord-reg/bypass/browser/node_modules/call-bind/test/callBound.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral14

Sample

discord-reg/bypass/browser/node_modules/call-bind/test/callBound.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral15

Sample

discord-reg/bypass/browser/node_modules/call-bind/test/index.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral16

Sample

discord-reg/bypass/browser/node_modules/call-bind/test/index.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral17

Sample

discord-reg/bypass/browser/node_modules/content-disposition/README.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral18

Sample

discord-reg/bypass/browser/node_modules/content-disposition/README.js

Resource

win10v2004-20230915-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral19

Sample

discord-reg/bypass/browser/node_modules/content-disposition/index.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral20

Sample

discord-reg/bypass/browser/node_modules/content-disposition/index.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral21

Sample

discord-reg/bypass/browser/node_modules/content-type/README.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral22

Sample

discord-reg/bypass/browser/node_modules/content-type/README.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral23

Sample

discord-reg/bypass/browser/node_modules/content-type/index.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral24

Sample

discord-reg/bypass/browser/node_modules/content-type/index.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral25

Sample

discord-reg/bypass/browser/node_modules/cookie-signature/Readme.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral26

Sample

discord-reg/bypass/browser/node_modules/cookie-signature/Readme.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral27

Sample

discord-reg/bypass/browser/node_modules/cookie-signature/index.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral28

Sample

discord-reg/bypass/browser/node_modules/cookie-signature/index.js

Resource

win10v2004-20230915-en

windows10-2004-x64

1 signatures

1800 seconds

Behavioral task

behavioral29

Sample

discord-reg/bypass/browser/node_modules/cookie/README.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral30

Sample

discord-reg/bypass/browser/node_modules/cookie/README.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Behavioral task

behavioral31

Sample

discord-reg/bypass/browser/node_modules/d/README.js

Resource

win7-20230831-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral32

Sample

discord-reg/bypass/browser/node_modules/d/README.js

Resource

win10v2004-20230915-en

windows10-2004-x64

0 signatures

1800 seconds

Report Analysis Logs

General

Target

discord-reg/bypass/browser/node_modules/bufferutil/prebuilds/win32-ia32/node.napi.dll
Size

119KB
MD5

a9a31006d8e08b481405b14d4e34c947
SHA1

1e9211daba2098653b1e917c2d69f7f9f2b0c544
SHA256

f321194b0b9ff9ab3197102083404f8848d58a592f4046df25d0319232ddd200
SHA512

7babcaa4e8e824751f07988b7ec79e12d955bda885a68f4a52173aa491dee51423ea26086d2972f1322d384503f2bb9ce0fe24867c2e6357129351b12b1bc846
SSDEEP

3072:GJyIiFdArQgNn71Tgaq83a+KrWz/Mk1cxIdVetk:GoBYD7Vq83NgWKsEtk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 2804	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2804	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2804	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2804	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2804	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2804	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2804	1944	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\discord-reg\bypass\browser\node_modules\bufferutil\prebuilds\win32-ia32\node.napi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\discord-reg\bypass\browser\node_modules\bufferutil\prebuilds\win32-ia32\node.napi.dll,#1
2⤵
PID:2804

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads