Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
04/05/2024, 17:23
General
-
Target
Exploiter/Exploiter.exe
-
Size
447KB
-
MD5
1f45fbe95cf28a77d25bf115cc3002fe
-
SHA1
c1483030959bb50c1a3875b8202852bffee0913c
-
SHA256
514e6cb42b3b1431e89a415af7d0a98e51e4239be0c085a1730c996eef71cd9d
-
SHA512
f58574dd9efdf44bdb81adb3e6c1381a59c9afd1c7486359a8efb310e6d0e94511770288ac47cbafa80e2cb3467cb57e0c7a7e9fecc1e012dd643cf79df5d5b4
-
SSDEEP
12288:XCQjgAtAHM+vetZxF5EWry8AJGy0x4xLe4:X5ZWs+OZVEWry8AFtxe4
Malware Config
Extracted
discordrat
-
discord_token
MTIzNjMwNTc2MjU5NTI0MjA1NQ.G6VLak.4vdqf2Zl4iPZ7e-AyK9ykkGmr9LZPBhhchrbdY
-
server_id
1236306342461964380
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exploiter\Exploiter.exe"C:\Users\Admin\AppData\Local\Temp\Exploiter\Exploiter.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Exploiter.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Exploiter.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD578c524f335315f9a5d39c4f129431801
SHA198b113cbbca0b1a0fd500f2ebc05fa7456c46b2d
SHA2563d44765f108d3a39af671642d57da473b66c668830e0cd1488478c749fb47520
SHA512c7e304ba344ad96fde2782fa232a30f92cb4c638153282ed5d0adc3c1d26a8331dca4d7737b79c3fafbc73cb5524b9282f063c852458d8a81e5c681eb90dcc12
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
56KB
-
Filesize
2.8MB