Analysis
-
max time kernel
24s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
-
submitted
23/02/2024, 14:47
General
-
Target
Nezur_cracked_by_pysen.exe
-
Size
78KB
-
MD5
7ab01d8727291679670263c2f1b128a1
-
SHA1
c98cd2a01bcb28164c066365eeca106f046ae26d
-
SHA256
890728f63ce1c4875b1404954c9e41f2dd43e5b29d37905325e770c0d20c1dcf
-
SHA512
6b4edf87f22855ef3ebd68353633a82747c7a730a3d2b113774055c144013797b2e4a1ab6bb19211b060b7b19771eec369e69326b3fcde19ab691c935958f9be
-
SSDEEP
1536:q2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPId:qZv5PDwbjNrmAE+DId
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIxMDAxMDUyMDc3MDU4MDUwMA.GkuSm6.X7nnB8gpGeBFbsnyKnNNzyFVTxUNi_qVUz7jzw
-
server_id
1197583538841735228
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nezur_cracked_by_pysen.exe"C:\Users\Admin\AppData\Local\Temp\Nezur_cracked_by_pysen.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C whoami2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
5.1MB
-
Filesize
9.9MB
-
Filesize
64KB