Resubmissions
25-06-2024 22:00
240625-1w1x8swcnh 10Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
25-06-2024 22:00
General
-
Target
Medusa.exe
-
Size
78KB
-
MD5
5b4483e4d0d5d3c245509d44f6ede105
-
SHA1
7f55b3ff41fa5a810e44d74b79f5bf3953882707
-
SHA256
379449b8c2d0053cea2aa786cf2ad6e3cd61e67793ac5b68be77358360b0ce42
-
SHA512
14066a18f5439efc767cecd347b658679ba39fc7135bcbe6f3c731ceb38ce614788015391df1ed2fcdda9233d2a655156126d298e94d7479ccfb99028fb2012a
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIwNDEwODc0MjM5Njg3MDczNw.Gw9Kyr.z1zBnV1wCUwvnB-hn8vkxiW22uEX8O5oY4F9Qk
-
server_id
1204106853043273729
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Medusa.exe"C:\Users\Admin\AppData\Local\Temp\Medusa.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
2.8MB