Overview

overview

10

Static

static

10

Coreblocks...er.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    78s
  • max time network
    80s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-06-2024 18:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Coreblocks_installer.exe

  • Size

    78KB

  • MD5

    95ab001f3a1ad27460c63c243dbbbb27

  • SHA1

    36f8766af10ff2afd84a6628d23447c08bcf2816

  • SHA256

    08fc3f3a770d3be10c6c6a8e1a81838609e8c61c1be9acb2582b2ed3f18b659f

  • SHA512

    98cdf38a464de4a5109d11619e2542dc4ea42eba9e771e9090aac046c790c4da6c2db22d6b274d77624dd631f76dc0ca4ef5c4cf36d86d72633e48bdc944b526

  • SSDEEP

    1536:92WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YPI/p:9Zv5PDwbjNrmAE+8I/p

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI1MTk1NzU1MDYxNDcxMjMyMA.GDc_Wk.Stu-pK596y-CCQ83DG6Cxthmo0jkoRyvGh4yrc

  • server_id

    1251943164726743177

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Coreblocks_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Coreblocks_installer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/516-0-0x00007FFFE8123000-0x00007FFFE8124000-memory.dmp
    Filesize

    4KB

    Download
  • memory/516-1-0x000001FBD39F0000-0x000001FBD3A08000-memory.dmp
    Filesize

    96KB

    Download
  • memory/516-2-0x000001FBEE010000-0x000001FBEE1D2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/516-3-0x00007FFFE8120000-0x00007FFFE8B0C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/516-4-0x000001FBEE810000-0x000001FBEED36000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/516-5-0x00007FFFE8120000-0x00007FFFE8B0C000-memory.dmp
    Filesize

    9.9MB

    Download