discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1254334525543288915/1254336947875217519/solarabootstraper[.]exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&

Analysis

max time kernel
30s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
25-06-2024 16:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzOTEzMTk4MTc4NzI5OTkxMg.G2PouQ.rmLVRC29c13dyUDlcJhFL4MtNpJCMM3OTOmuyI
server_id
1254334525543288912

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

solarabootstraper.exetest.exesolarabootstraper.exetest.exe

pid process

2960 solarabootstraper.exe
1788 test.exe
1828 solarabootstraper.exe
4452 test.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

13 discord.com
20 discord.com
22 discord.com
24 discord.com
26 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2960	solarabootstraper.exe
1788	test.exe
1828	solarabootstraper.exe
4452	test.exe

flow	ioc
13	discord.com
20	discord.com
22	discord.com
24	discord.com
26	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 602820.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4208	msedge.exe
4208	msedge.exe
1144	msedge.exe
1144	msedge.exe
4756	identity_helper.exe
4756	identity_helper.exe
404	msedge.exe
404	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1144 msedge.exe
1144 msedge.exe
1144 msedge.exe
1144 msedge.exe
1144 msedge.exe
1144 msedge.exe
1144 msedge.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

test.exetest.exe

description pid process

Token: SeDebugPrivilege 1788 test.exe
Token: SeDebugPrivilege 4452 test.exe
Token: SeShutdownPrivilege 1788 test.exe

description	pid	process
Token: SeDebugPrivilege	1788	test.exe
Token: SeDebugPrivilege	4452	test.exe
Token: SeShutdownPrivilege	1788	test.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1144 wrote to memory of 1648	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 1648	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 3640	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4208	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4208	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe
PID 1144 wrote to memory of 4028	1144	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffd1ab53cb8,0x7ffd1ab53cc8,0x7ffd1ab53cd8
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
2⤵
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
2⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
2⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5484 /prefetch:8
2⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888

C:\Users\Admin\Downloads\solarabootstraper.exe
"C:\Users\Admin\Downloads\solarabootstraper.exe"
2⤵
- Executes dropped EXE
PID:2960

C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
2⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
2⤵
PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1952

C:\Users\Admin\Downloads\solarabootstraper.exe
"C:\Users\Admin\Downloads\solarabootstraper.exe"
1⤵
- Executes dropped EXE
PID:1828

C:\Users\Admin\AppData\Local\Temp\RarSFX1\test.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\test.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6f738fcca0370135adb459fac0d129b9

SHA1
5af8b563ee883e0b27c1c312dc42245135f7d116

SHA256
1d37a186c9be361a782dd6e45fe98b1f74215a26990af945a2b8b9aa4587ec63

SHA512
8749675cdd8f667ff7ca0a0f04d5d9cad9121fd02ed786e66bcd3c1278d8eb9ce5995d3e38669612bdc4dccae83a2d1b10312db32d5097ef843512244f6f769a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
68de3df9998ac29e64228cf1c32c9649

SHA1
be17a7ab177bef0f03c9d7bd2f25277d86e8fcee

SHA256
96825c1e60e4a87dc5dbae78b97104e6968275fa1602c69053d0192cae143f43

SHA512
1658b0bc504a8a5c57c496477cd800a893d751f03d632ef50aff9327cd33ad0e4e4f27bcb85b20bd22bef2ca65600b7d92e2a1f18fd3d08ad6391983de77beaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
710f21be8f099e8692e82c8c3ae6533a

SHA1
2758498fd106fbf4c2ef34527a298639dfbc6daa

SHA256
3054777a3706c91fb6afe89204ea6a07ed462336964310b8a4afb20520f1fa51

SHA512
9caea9b3f94b6fd229f711e50daf9de52d24b9dbeff2d9ad9af2fdd018cdf73c23711bf21b9bb549826c312a1ade1956ec0f40bce7a248dcff37e055566a2ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
5d641ace5c12878ac7eb50092b0a4290

SHA1
c00bf409ba8df2473306201bf3ca88c647f21dd4

SHA256
7b466bdd86d88f6160874c59433ed7b6e94ca244144d5f08ff3ec6ac3834a623

SHA512
857971d2dba34bdfdd1f24f93858826ddc9e8ddb1fa338d39bb31152333d585d5cd36332c86c34edc9c46c86dbd2f5c62dddbfb20dbd01d6a41a652da5188d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4164dee8c0964bfeeb69201eda029051

SHA1
83cc5c65bde47f554f1a352672fc24284407fc7d

SHA256
2394e0aaa4217786c80c35c5d8369ea7b3264db2e8f07e6124ab1ee0dee493fd

SHA512
0f87656cd660a6147ae3961020fa211cd36dbbd33672f2a36ca0d39f1f1fc7bb4f6b4f5b60b93761379b73090a0b319a0146797dd70f2e707c090b6f58c6ad3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
Filesize
78KB

MD5
cd0398fb5a04ce43be2b1183e7dfad06

SHA1
e1e9ac1f1f2533f3bfec802cae2cbeeeac65c181

SHA256
c4fb94399b109d19585a03233be7663000aae8c7c7f8661ce744c59bfa8ced08

SHA512
50bfd2614078082fd83e43e61a36b086eae0fec2399fae5655c6442a474ffb7c25cabe43b4c484c85acc4fac72c2f2613dc00e85045242dfcdd91093519699bc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 602820.crdownload
Filesize
497KB

MD5
48258af1b1134dffa388c6f2590325c3

SHA1
e2fa6a4351d7b358e6b20e9194b63b54751458d4

SHA256
d0452f63e207ead4ba0828fba9cd46d54c08906ac3f35f1c0b27dda2d60fbc83

SHA512
1eeceefb8843f72b55e1b517039ab53cd72af3bb294fe9b06ce0a6207749506bf299cd913a4a1088ffa002069821d346ec3fc045fa701014110beec03d7d208c

Download Submit
C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier
Filesize
229B

MD5
d1a3dba820e810bf857af29be2174171

SHA1
1c14f3fb4d2f99de64385f405a768cba12bd6993

SHA256
24b83d81b6ed1f53babbae3ac4af8e18dd376a5f1a2bdb1d4859d4cd2e2e5cc8

SHA512
e39d2d0ab8d6e3caed651b4ec7ff1d9754b452ad6b325e58fe3f8a73a8c9cc686385190153f5ca647880fcfeca57eeac4fae35c8b83a5fb5f71a941c2cfc162a

Download Submit
\??\pipe\LOCAL\crashpad_1144_QBDIWZGDJHDMYILF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1788-102-0x000001AC5FEE0000-0x000001AC5FEF8000-memory.dmp

Filesize
96KB

Download
memory/1788-103-0x000001AC7A5D0000-0x000001AC7A792000-memory.dmp

Filesize
1.8MB

Download
memory/1788-104-0x000001AC7AE20000-0x000001AC7B348000-memory.dmp

Filesize
5.2MB

Download
memory/1788-132-0x00007FFD260F0000-0x00007FFD26132000-memory.dmp

Filesize
264KB

Download
memory/1788-135-0x00007FFD26650000-0x00007FFD26687000-memory.dmp

Filesize
220KB

Download
memory/1788-136-0x00007FFD26690000-0x00007FFD266B8000-memory.dmp

Filesize
160KB

Download
memory/1788-133-0x00007FFD25D30000-0x00007FFD25DD1000-memory.dmp

Filesize
644KB

Download
memory/1788-134-0x00007FFD1DA90000-0x00007FFD1DAA5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads