Analysis
-
max time kernel
130s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 12:13
Behavioral task
behavioral1
Sample
NigaMafia's Boss.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NigaMafia's Boss.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
NigaMafia's Boss.exe
-
Size
78KB
-
MD5
21885f673ab1e5656712d1946e139a95
-
SHA1
af4b0886b99640a98fde66638a08e21fe6acda52
-
SHA256
60f1773412433537eb8d178603df50ed19b70e53bcfccac1265e55af704de749
-
SHA512
324c0cf0e7cd6d378f32d7e539ffd2f25afe5a487f0d1bedc864e58b0f7c3d66f00dd87aa53c915d745694dc2c1a324e97803a5c42276894b32eff17c6d6979c
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIwNzMzNzU2MDQ2MDc2MzE3Ng.GN_Yaj.0dKAdTpvE5EiY68CCdI2lKg80pcq5NJa3CMGIE
-
server_id
1182383459306586163
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 268 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe 268 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2156 2788 NigaMafia's Boss.exe 28 PID 2788 wrote to memory of 2156 2788 NigaMafia's Boss.exe 28 PID 2788 wrote to memory of 2156 2788 NigaMafia's Boss.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NigaMafia's Boss.exe"C:\Users\Admin\AppData\Local\Temp\NigaMafia's Boss.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2788 -s 5962⤵PID:2156
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:268