Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
25-04-2024 23:45
General
-
Target
prestigev2.exe
-
Size
470KB
-
MD5
ab5ff00162c761144b4d02486b3c0b08
-
SHA1
102111e6d7cd70274a2b9e5c57d3099ee8f0e79f
-
SHA256
4d12cef8e56f92b53f548491b58deb9e774c3739301b7d21d87d62cf1256831b
-
SHA512
18a2fe795c92d00b0523d460c2f460515d9b39979c694a93f4d47f13f429f518b94db0c39c176d32d1e9ecb84eaa7e33e4d53814b31c8d206296ad9543b696ba
-
SSDEEP
6144:XE+yclwQKjdn+WPtYVJIoBfUuC4jI4eYOywyKQtgKuXQAZKRZS5jMfUoTf:XBdlwHRn+WlYV+934jQYOywjggga2j
Malware Config
Extracted
discordrat
-
discord_token
MTIyNzQyMzE4MDEwMTEyNDEyNw.GQOmio.DYcpMY415SdKKyjsQySmQRxNjb4DdWgtJzAzRQ
-
server_id
1233198387088719893
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\prestigev2.exe"C:\Users\Admin\AppData\Local\Temp\prestigev2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\prestigev2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\prestigev2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD531ff6dff28087c4fc5063bcf1c8c5fa3
SHA123efd0b9c4332fc1cdba826397118f6ed9014b07
SHA2566532fc3a9276a748d0546613f84e64fed0c5fad50ef27e31914366aec68aa023
SHA512ceb4f12fb87b90b696229e1ae049aaab1f7adf9d5fc4b1005dcbcb1ea97684d03d2f8a548586dead15c607c0dbdcd6e707ccd1dfb8edf30f3914482e34072807
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
120KB