discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1254334525543288915/1254336947875217519/solarabootstraper[.]exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&

Analysis

max time kernel
30s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
25/06/2024, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&
Sample240625-ttmt9stakp

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzOTEzMTk4MTc4NzI5OTkxMg.G2PouQ.rmLVRC29c13dyUDlcJhFL4MtNpJCMM3OTOmuyI
server_id
1254334525543288912

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2960	solarabootstraper.exe
1788	test.exe
1828	solarabootstraper.exe
4452	test.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
13	discord.com
20	discord.com
22	discord.com
24	discord.com
26	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 602820.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
1144	msedge.exe
1144	msedge.exe
4756	identity_helper.exe
4756	identity_helper.exe
404	msedge.exe
404	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	test.exe
Token: SeDebugPrivilege	4452	test.exe
Token: SeShutdownPrivilege	1788	test.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1648	1144	msedge.exe	81
PID 1144 wrote to memory of 1648	1144	msedge.exe	81
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 3640	1144	msedge.exe	82
PID 1144 wrote to memory of 4208	1144	msedge.exe	83
PID 1144 wrote to memory of 4208	1144	msedge.exe	83
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84
PID 1144 wrote to memory of 4028	1144	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffd1ab53cb8,0x7ffd1ab53cc8,0x7ffd1ab53cd8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Users\Admin\Downloads\solarabootstraper.exe
  "C:\Users\Admin\Downloads\solarabootstraper.exe"
  2⤵
  - Executes dropped EXE
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10717586702533705805,11613978350705603388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1952

C:\Users\Admin\Downloads\solarabootstraper.exe
"C:\Users\Admin\Downloads\solarabootstraper.exe"
1⤵
- Executes dropped EXE
PID:1828
- C:\Users\Admin\AppData\Local\Temp\RarSFX1\test.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1d37a186c9be361a782dd6e45fe98b1f74215a26990af945a2b8b9aa4587ec63
MD5 6f738fcca0370135adb459fac0d129b9
SHA1 5af8b563ee883e0b27c1c312dc42245135f7d116
SHA512 8749675cdd8f667ff7ca0a0f04d5d9cad9121fd02ed786e66bcd3c1278d8eb9ce5995d3e38669612bdc4dccae83a2d1b10312db32d5097ef843512244f6f769a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 96825c1e60e4a87dc5dbae78b97104e6968275fa1602c69053d0192cae143f43
MD5 68de3df9998ac29e64228cf1c32c9649
SHA1 be17a7ab177bef0f03c9d7bd2f25277d86e8fcee
SHA512 1658b0bc504a8a5c57c496477cd800a893d751f03d632ef50aff9327cd33ad0e4e4f27bcb85b20bd22bef2ca65600b7d92e2a1f18fd3d08ad6391983de77beaf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3054777a3706c91fb6afe89204ea6a07ed462336964310b8a4afb20520f1fa51
MD5 710f21be8f099e8692e82c8c3ae6533a
SHA1 2758498fd106fbf4c2ef34527a298639dfbc6daa
SHA512 9caea9b3f94b6fd229f711e50daf9de52d24b9dbeff2d9ad9af2fdd018cdf73c23711bf21b9bb549826c312a1ade1956ec0f40bce7a248dcff37e055566a2ba8
SSDEEP 96:nRKk3PhhD+BkkG90wSv0MoiVmdHItJ/AU0WQyV+VuziX3wI3:nRKk3rD+BkkG+v0MAI3/AULM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7b466bdd86d88f6160874c59433ed7b6e94ca244144d5f08ff3ec6ac3834a623
MD5 5d641ace5c12878ac7eb50092b0a4290
SHA1 c00bf409ba8df2473306201bf3ca88c647f21dd4
SHA512 857971d2dba34bdfdd1f24f93858826ddc9e8ddb1fa338d39bb31152333d585d5cd36332c86c34edc9c46c86dbd2f5c62dddbfb20dbd01d6a41a652da5188d82
SSDEEP 96:nRKk3PuhD+BkkG90wSv0MoiVmdHItJ+BAU0WQyV+VpAiX3wI3:nRKk3cD+BkkG+v0MAI3KAULe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2394e0aaa4217786c80c35c5d8369ea7b3264db2e8f07e6124ab1ee0dee493fd
MD5 4164dee8c0964bfeeb69201eda029051
SHA1 83cc5c65bde47f554f1a352672fc24284407fc7d
SHA512 0f87656cd660a6147ae3961020fa211cd36dbbd33672f2a36ca0d39f1f1fc7bb4f6b4f5b60b93761379b73090a0b319a0146797dd70f2e707c090b6f58c6ad3f
SSDEEP 192:UoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGr9Nme2RUJRaxaRH6Apa7YvmT:09iIxuERzA83h09RZxASGUHC6Ca7Yk97
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
Size 78KB
SHA256 c4fb94399b109d19585a03233be7663000aae8c7c7f8661ce744c59bfa8ced08
MD5 cd0398fb5a04ce43be2b1183e7dfad06
SHA1 e1e9ac1f1f2533f3bfec802cae2cbeeeac65c181
SHA512 50bfd2614078082fd83e43e61a36b086eae0fec2399fae5655c6442a474ffb7c25cabe43b4c484c85acc4fac72c2f2613dc00e85045242dfcdd91093519699bc
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xYPIC:5Zv5PDwbjNrmAE+GIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 602820.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 602820.crdownload
Size 497KB
SHA256 d0452f63e207ead4ba0828fba9cd46d54c08906ac3f35f1c0b27dda2d60fbc83
MD5 48258af1b1134dffa388c6f2590325c3
SHA1 e2fa6a4351d7b358e6b20e9194b63b54751458d4
SHA512 1eeceefb8843f72b55e1b517039ab53cd72af3bb294fe9b06ce0a6207749506bf299cd913a4a1088ffa002069821d346ec3fc045fa701014110beec03d7d208c
SSDEEP 12288:4yveQB/fTHIGaPkKEYzURNA/bAgzfCxS6PZXOB4:4uDXTIGaPhEYzUzAT4SwZXv
MD5 SHA1 SHA512 SSDEEP

Submit Download

solarabootstraper.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier
Size 229B
SHA256 24b83d81b6ed1f53babbae3ac4af8e18dd376a5f1a2bdb1d4859d4cd2e2e5cc8
MD5 d1a3dba820e810bf857af29be2174171
SHA1 1c14f3fb4d2f99de64385f405a768cba12bd6993
SHA512 e39d2d0ab8d6e3caed651b4ec7ff1d9754b452ad6b325e58fe3f8a73a8c9cc686385190153f5ca647880fcfeca57eeac4fae35c8b83a5fb5f71a941c2cfc162a
MD5 SHA1 SHA512

Submit Download

memory/1788-102-0x000001AC5FEE0000-0x000001AC5FEF8000-memory.dmp

Download

memory/1788-103-0x000001AC7A5D0000-0x000001AC7A792000-memory.dmp

Download

memory/1788-104-0x000001AC7AE20000-0x000001AC7B348000-memory.dmp

Download

memory/1788-132-0x00007FFD260F0000-0x00007FFD26132000-memory.dmp

Download

memory/1788-135-0x00007FFD26650000-0x00007FFD26687000-memory.dmp

Download

memory/1788-136-0x00007FFD26690000-0x00007FFD266B8000-memory.dmp

Download

memory/1788-133-0x00007FFD25D30000-0x00007FFD25DD1000-memory.dmp

Download

memory/1788-134-0x00007FFD1DA90000-0x00007FFD1DAA5000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads