Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
03/01/2024, 08:44
240103-knm4eacdcm 303/01/2024, 08:42
240103-kl956afaf7 1003/01/2024, 08:35
240103-khc19acdbm 10Analysis
-
max time kernel
5s -
max time network
44s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/01/2024, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
hehegnp.scr
Resource
win11-20231215-en
General
-
Target
hehegnp.scr
-
Size
1.3MB
-
MD5
a34f34fb4c3b4c36b3b81f97cdcb7ca3
-
SHA1
b56023dc51011bec0e91e54c9729f6e633a08867
-
SHA256
47680c12b9b928ff642864694790d799cd419668c4c96bdb58b1ae2818dbb574
-
SHA512
dfda79a26f6e419b07920efc27e5b8c40de4ca2a2d839c675c99cc8eb9bbb2b98b80729ecf36e3ef7fa247b41f51e8193e6cd874fe08418272a50d34d9a95cce
-
SSDEEP
24576:BNA3R5drX46t/YOd4prFamZa3wtdnJJ9NHuFkZhSq/JvU21wVcj2F76aP2GZ39wf:k546dbChJg3wtxz99ueZhSqtU2eVm2J0
Malware Config
Extracted
discordrat
-
discord_token
MTE5MTk5ODM3NTg4OTk5Mzc4MA.G8Z16P.3jjREwtvwZBkdqbzBAXhIsaJmyZEYrq_haoKWM
-
server_id
1060150467436499004
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5b276f6c9a652197f36c8ef95441b4840
SHA15ccfb78de6c40fce8145fa5725176d0c556d22a7
SHA2567036bea5264e75b932fa942f337ad028e22bbd8e7bdfd9cad10241538aa07d60
SHA5127c4ae8c8aab416a56974fcfba1bc09dd84a1c43a26bf5d74cbf667ea86827d2949006e74f9e16eba2a67a52af47e4972f7c2a5f681f407e0af6e67998aecf209