Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/03/2024, 15:01

General

  • Target

    MoMowA.exe

  • Size

    78KB

  • MD5

    2134f0cbed3a8398034cb78610a0ffe4

  • SHA1

    966b3cb2ec2d3494f7aaffca9bad5559c6d4c320

  • SHA256

    9e0574b31c5dc6356e84796082be6f7ff319bc43c57b24657d1e6930c863018a

  • SHA512

    936d2282287b2ca788c82a6afbbe8d6733375c52ad70cff55e2798463e41706cf36de6bc71c74e8aca7f487f96b4ea918c3469500cc03f2fd446bea6cc85e346

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIxMzg1OTc0OTA5OTk5NTE1Ng.GrWby9.mJ91kTjDMlDqeg1nwJTmQUCJaPjtYk5eenqOnU

  • server_id

    1213859181925240924

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MoMowA.exe
    "C:\Users\Admin\AppData\Local\Temp\MoMowA.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4856-0-0x0000016C641C0000-0x0000016C641D8000-memory.dmp

    Filesize

    96KB

  • memory/4856-1-0x0000016C7E860000-0x0000016C7EA22000-memory.dmp

    Filesize

    1.8MB

  • memory/4856-2-0x00007FFA43930000-0x00007FFA443F1000-memory.dmp

    Filesize

    10.8MB

  • memory/4856-3-0x0000016C7EC10000-0x0000016C7EC20000-memory.dmp

    Filesize

    64KB

  • memory/4856-4-0x0000016C7F150000-0x0000016C7F678000-memory.dmp

    Filesize

    5.2MB

  • memory/4856-5-0x00007FFA43930000-0x00007FFA443F1000-memory.dmp

    Filesize

    10.8MB

  • memory/4856-6-0x0000016C7EC10000-0x0000016C7EC20000-memory.dmp

    Filesize

    64KB