Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    26s
  • max time network
    59s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/04/2024, 14:14

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    901cefc057201e055bf5811e52f1d3c6

  • SHA1

    7eedcc00e7d71c86c752d6ed11c740dd91b2e078

  • SHA256

    591157c7b3acd00b0dfc7434133a5cd492fc2dfcf632f406051b9d66dcd33d5a

  • SHA512

    7c3a57849b2efd31f258378135c9affa71d4504d7f25757a055cbe12b4c83d38a8049db6109624a8ec6e45150c0ee7f9995c8280af313f500aa68218da62e4ca

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIyNTQ0Mzk5NzkwMDYwMzQ1Nw.GWuERT.FvjiredISYysQu4CtwubME2Lb2KTKTUG8SW5yM

  • server_id

    1225162463952109721

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3444-0-0x000002C7A0360000-0x000002C7A0378000-memory.dmp

    Filesize

    96KB

  • memory/3444-1-0x000002C7BAAB0000-0x000002C7BAC72000-memory.dmp

    Filesize

    1.8MB

  • memory/3444-2-0x00007FF874050000-0x00007FF874B12000-memory.dmp

    Filesize

    10.8MB

  • memory/3444-3-0x000002C7BAA20000-0x000002C7BAA30000-memory.dmp

    Filesize

    64KB

  • memory/3444-4-0x000002C7BBD80000-0x000002C7BC2A8000-memory.dmp

    Filesize

    5.2MB

  • memory/3444-5-0x000002C7BAA30000-0x000002C7BAAA6000-memory.dmp

    Filesize

    472KB

  • memory/3444-6-0x000002C7A0870000-0x000002C7A0882000-memory.dmp

    Filesize

    72KB

  • memory/3444-7-0x000002C7A08A0000-0x000002C7A08BE000-memory.dmp

    Filesize

    120KB

  • memory/3444-8-0x00007FF874050000-0x00007FF874B12000-memory.dmp

    Filesize

    10.8MB

  • memory/3444-9-0x000002C7BAA20000-0x000002C7BAA30000-memory.dmp

    Filesize

    64KB