Overview

overview

10

Static

static

10

GTA5-FINAL...SE.exe

windows11-21h2-x64

10

Resubmissions

Analysis

  • max time kernel
    125s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-06-2024 10:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GTA5-FINAL-RELEASE.exe

  • Size

    78KB

  • MD5

    7ca4d82e1aa342c82da6007947163259

  • SHA1

    7875f56bcbb94747c85a54f8bdd465d866e01965

  • SHA256

    689481c56c91f86cf9e6d034cb714e3c92723af3035c00c3c339fcb384258e55

  • SHA512

    1685a6a2169d1ff6daec4de8c4d48d6035048e2604ff28b4aef6de168785d28c60793d417b9d29bb5e81831c595871f9cdee1aed1eec5f1cbb4dd8f5f746b633

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0Njg5OTQxNDg5NTk1MTk4Mw.Gcxhsz.QV1m4KTtP0M77UZ2GaIPNr05TtimA7gY4NjqcQ

  • server_id

    1246899988789989576

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GTA5-FINAL-RELEASE.exe
    "C:\Users\Admin\AppData\Local\Temp\GTA5-FINAL-RELEASE.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:884
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:5000
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2476

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/884-0-0x00007FFCF84D3000-0x00007FFCF84D5000-memory.dmp
      Filesize

      8KB

      Download
    • memory/884-1-0x0000021946780000-0x0000021946798000-memory.dmp
      Filesize

      96KB

      Download
    • memory/884-2-0x0000021960EE0000-0x00000219610A2000-memory.dmp
      Filesize

      1.8MB

      Download
    • memory/884-3-0x00007FFCF84D0000-0x00007FFCF8F92000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/884-4-0x0000021962240000-0x0000021962768000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/884-5-0x00007FFCF84D3000-0x00007FFCF84D5000-memory.dmp
      Filesize

      8KB

      Download
    • memory/884-6-0x00007FFCF84D0000-0x00007FFCF8F92000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/2476-23-0x000001289F840000-0x000001289F850000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2476-7-0x000001289F740000-0x000001289F750000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2476-39-0x00000128A7E30000-0x00000128A7E31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-40-0x00000128A7E30000-0x00000128A7E31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-41-0x00000128A7E30000-0x00000128A7E31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-42-0x00000128A7E30000-0x00000128A7E31000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-43-0x00000128A7E40000-0x00000128A7E41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-44-0x00000128A7E40000-0x00000128A7E41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-45-0x00000128A7E40000-0x00000128A7E41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-46-0x00000128A7E40000-0x00000128A7E41000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-47-0x00000128A7E50000-0x00000128A7E51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-48-0x00000128A7E50000-0x00000128A7E51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-49-0x00000128A7E50000-0x00000128A7E51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-50-0x00000128A7A80000-0x00000128A7A81000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-51-0x00000128A7A70000-0x00000128A7A71000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-53-0x00000128A7A80000-0x00000128A7A81000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-56-0x00000128A7A70000-0x00000128A7A71000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-59-0x00000128A79B0000-0x00000128A79B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-67-0x00000128A7BB0000-0x00000128A7BB1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-69-0x00000128A7BC0000-0x00000128A7BC1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-71-0x00000128A7CD0000-0x00000128A7CD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2476-70-0x00000128A7BC0000-0x00000128A7BC1000-memory.dmp
      Filesize

      4KB

      Download