Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1794s
  • max time network
    1165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 18:04

General

  • Target

    tszpullertool.exe

  • Size

    78KB

  • MD5

    490e1d60373872243f705bdf46aab56a

  • SHA1

    066dc2cd21f2289e6bf52e374c93480fa165d8f8

  • SHA256

    a71b6a07ff699594a51120bd9634c46b7eafef39d43c1139439ac846280fd32a

  • SHA512

    d76824c27a16e39ee6d92a32b6db3f70c0d1d026c934a690ab087851df993fc7197027dc8c077db6fc1eb660afb0eed71ef2d43d1d117b81885b52d1568dbeb6

  • SSDEEP

    1536:M2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPI2:MZv5PDwbjNrmAE+DI2

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIwNjYzMDA2MDg1NDA4MzYzNA.GvVyvp.mAZUqpiSErc4n9lJ5dxHXEniOy_EsnBOiN0dn4

  • server_id

    1217894352093708318

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tszpullertool.exe
    "C:\Users\Admin\AppData\Local\Temp\tszpullertool.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:808
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:2156
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4332

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/808-0-0x000001DA02EE0000-0x000001DA02EF8000-memory.dmp

      Filesize

      96KB

    • memory/808-1-0x000001DA1D4B0000-0x000001DA1D672000-memory.dmp

      Filesize

      1.8MB

    • memory/808-2-0x00007FFDEECC0000-0x00007FFDEF781000-memory.dmp

      Filesize

      10.8MB

    • memory/808-3-0x000001DA04BC0000-0x000001DA04BD0000-memory.dmp

      Filesize

      64KB

    • memory/808-4-0x000001DA1DCB0000-0x000001DA1E1D8000-memory.dmp

      Filesize

      5.2MB

    • memory/808-5-0x00007FFDEECC0000-0x00007FFDEF781000-memory.dmp

      Filesize

      10.8MB

    • memory/808-7-0x00007FFDEECC0000-0x00007FFDEF781000-memory.dmp

      Filesize

      10.8MB

    • memory/4332-8-0x000001B604440000-0x000001B604450000-memory.dmp

      Filesize

      64KB

    • memory/4332-24-0x000001B604540000-0x000001B604550000-memory.dmp

      Filesize

      64KB

    • memory/4332-40-0x000001B60CB00000-0x000001B60CB01000-memory.dmp

      Filesize

      4KB

    • memory/4332-41-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-43-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-42-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-44-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-45-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-46-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-47-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-48-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-49-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-50-0x000001B60CB30000-0x000001B60CB31000-memory.dmp

      Filesize

      4KB

    • memory/4332-51-0x000001B60C750000-0x000001B60C751000-memory.dmp

      Filesize

      4KB

    • memory/4332-52-0x000001B60C740000-0x000001B60C741000-memory.dmp

      Filesize

      4KB

    • memory/4332-54-0x000001B60C750000-0x000001B60C751000-memory.dmp

      Filesize

      4KB

    • memory/4332-57-0x000001B60C740000-0x000001B60C741000-memory.dmp

      Filesize

      4KB

    • memory/4332-60-0x000001B60C680000-0x000001B60C681000-memory.dmp

      Filesize

      4KB

    • memory/4332-72-0x000001B60C880000-0x000001B60C881000-memory.dmp

      Filesize

      4KB

    • memory/4332-74-0x000001B60C890000-0x000001B60C891000-memory.dmp

      Filesize

      4KB

    • memory/4332-75-0x000001B60C890000-0x000001B60C891000-memory.dmp

      Filesize

      4KB

    • memory/4332-76-0x000001B60C9A0000-0x000001B60C9A1000-memory.dmp

      Filesize

      4KB