771a233f35d5aca0d9d7b0621fa3ea9d8f816f6a1741813f6c781f07e50c77f9

Analysis

max time kernel
1s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/12/2023, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiscordChatExporter.Core.pdb
Size

92KB
MD5

cd50a3e79c702faa7b2799a48a7e4bc8
SHA1

f1d7800f7865b7a216be426d13957da03d0d0f91
SHA256

124bf5286e8fbcc11a4c5612480e3472ac7fec3d6b1dbdadeb65dcb9e8ffa82b
SHA512

017e35c422ab961d857a6cfac527d7324c0457ec436db5f8e0b6324de6c89df504d258060392c07b5e5933cf447f46d31083e8d79061acf02bbebeeee22351dd
SSDEEP

1536:dmy/QkRmjUFRiU7feTDVJCwuwm7pDQDC3e9mDtC07UsRA+Aa0V7NYkxUGBZBK:dm2J5Mlm7pDYr9YtVUsuHai7/3g

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2852	2172	cmd.exe	17
PID 2172 wrote to memory of 2852	2172	cmd.exe	17
PID 2172 wrote to memory of 2852	2172	cmd.exe	17

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DiscordChatExporter.Core.pdb
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DiscordChatExporter.Core.pdb
  2⤵
  PID:2852
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DiscordChatExporter.Core.pdb"
    3⤵
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
1KB

MD5
c3330ce606efe9ba2ce95873319915ae

SHA1
9fe3ee97a1ec96e802f9b459d600db7f7c4294ea

SHA256
3890fba718e4526213f06785244784f62b5dc3b92f9c410728e07ae76fa00c2b

SHA512
cc3f743a69e9e3bea81f881d0992b90d49b82f0606a758b56e6d42ea907b99e96dae4569e534f8c6aab17bb7339b63db056e067fd425ac5a719ff2bf66d9d1d1

Download Submit