Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/01/2024, 08:44

240103-knm4eacdcm 3

03/01/2024, 08:42

240103-kl956afaf7 10

03/01/2024, 08:35

240103-khc19acdbm 10

Analysis

  • max time kernel
    5s
  • max time network
    44s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/01/2024, 08:35

General

  • Target

    hehegnp.scr

  • Size

    1.3MB

  • MD5

    a34f34fb4c3b4c36b3b81f97cdcb7ca3

  • SHA1

    b56023dc51011bec0e91e54c9729f6e633a08867

  • SHA256

    47680c12b9b928ff642864694790d799cd419668c4c96bdb58b1ae2818dbb574

  • SHA512

    dfda79a26f6e419b07920efc27e5b8c40de4ca2a2d839c675c99cc8eb9bbb2b98b80729ecf36e3ef7fa247b41f51e8193e6cd874fe08418272a50d34d9a95cce

  • SSDEEP

    24576:BNA3R5drX46t/YOd4prFamZa3wtdnJJ9NHuFkZhSq/JvU21wVcj2F76aP2GZ39wf:k546dbChJg3wtxz99ueZhSqtU2eVm2J0

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTE5MTk5ODM3NTg4OTk5Mzc4MA.G8Z16P.3jjREwtvwZBkdqbzBAXhIsaJmyZEYrq_haoKWM

  • server_id

    1060150467436499004

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\hehegnp.scr
    "C:\Users\Admin\AppData\Local\Temp\hehegnp.scr" /S
    1⤵
      PID:2540
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\nitro.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\nitro.exe"
        2⤵
          PID:1952

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\nitro.exe

        Filesize

        78KB

        MD5

        b276f6c9a652197f36c8ef95441b4840

        SHA1

        5ccfb78de6c40fce8145fa5725176d0c556d22a7

        SHA256

        7036bea5264e75b932fa942f337ad028e22bbd8e7bdfd9cad10241538aa07d60

        SHA512

        7c4ae8c8aab416a56974fcfba1bc09dd84a1c43a26bf5d74cbf667ea86827d2949006e74f9e16eba2a67a52af47e4972f7c2a5f681f407e0af6e67998aecf209

      • memory/1952-14-0x000001C5D9F60000-0x000001C5D9F78000-memory.dmp

        Filesize

        96KB

      • memory/1952-15-0x000001C5F4680000-0x000001C5F4842000-memory.dmp

        Filesize

        1.8MB

      • memory/1952-16-0x00007FFECCFB0000-0x00007FFECDA72000-memory.dmp

        Filesize

        10.8MB

      • memory/1952-17-0x000001C5F45B0000-0x000001C5F45C0000-memory.dmp

        Filesize

        64KB

      • memory/1952-18-0x000001C5F5950000-0x000001C5F5E78000-memory.dmp

        Filesize

        5.2MB

      • memory/1952-19-0x00007FFECCFB0000-0x00007FFECDA72000-memory.dmp

        Filesize

        10.8MB