Behavioral task
behavioral1
Sample
CoolMods.exe
Resource
win10-20240404-en
General
-
Target
CoolMods.exe
-
Size
78KB
-
MD5
ca9bd14e43e32ac225ca5a1f0ac78688
-
SHA1
a14b80b814801e67086735cde8955ecd14b0262e
-
SHA256
258ccb0c1dbfc2fbe13da1c515f9f903ea7803dbd2a990ad5574763048a3e30f
-
SHA512
cdcb4b4a2c75b9a65f3612d41160707bab67888d45860aaee83fd44aba998565817feffede5eb9b8fcf0f513adc3d11cc00119d6143d6cfffa60bdaf4796b850
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YPIC:5Zv5PDwbjNrmAE+8IC
Malware Config
Extracted
discordrat
-
discord_token
MTI0NjI4OTUyODIyNzEwMjgyMw.G00x3v.G3ebYAE_DKraHpsoWYH78Oi_9kTyhdFrGvNm0o
-
server_id
1209686999565475910
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CoolMods.exe
Files
-
CoolMods.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ