Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
23-04-2024 02:15
Errors
Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-23T02:17:57Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10-20240404-en/instance_7-dirty.qcow2\"}"
General
-
Target
XPsycho Cheats.exe
-
Size
78KB
-
MD5
acfe98b80f2cc1929151b81428ce26bf
-
SHA1
3d221a1850320f3a7f996778d5625b6e6fa24f40
-
SHA256
4f2be08bc6395869cfb71741c4803ce5e8b68fd365bd1d7fe98a7aacee767ae1
-
SHA512
8f1452f4111f77038048fb3c747fcc9133594e1929c396863b22f36e2aa7bf3aa6e80c8ccafa39f95fe7e90dc5fc031e00b222b548b44c3e3757ccec6f2ac8ba
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIzMjE0OTc3MzQ5NTMwNDMwNA.Gkp4-u.iV4nsscSdQyxBohbfKg-cwo6OGwImN17S7r0x4
-
server_id
1232150214391890031
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XPsycho Cheats.exe"C:\Users\Admin\AppData\Local\Temp\XPsycho Cheats.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aed855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
5.1MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
9.9MB