Overview

overview

10

Static

static

10

Ledger Live.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    3s
  • max time network
    9s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-07-2024 00:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ledger Live.exe

  • Size

    78KB

  • MD5

    ff034f25a5c7749b20534e973413b277

  • SHA1

    0a7c06348d631daa07d6544d7b0034f926ec2dfe

  • SHA256

    69d005df11270b29fc78e5c57927a9e6d6eac7a47efd24df7def5785dff516ab

  • SHA512

    6dc4db53c88ddc3a44a4b4929cd4858bb377a31c3b7b0aad6a658bd1e56dddc31d4d2c57f6dfa421bf2efbd80d33a924e0732e673b1a13ac40a0cc22c0060a74

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI1NDM4NTI1ODkwMDYyMzQxMA.GAgrmc.PWvOjnSV32zpcU4H56pDAxRzID5S28B7mDWsRo

  • server_id

    1254108100558979262

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ledger Live.exe
    "C:\Users\Admin\AppData\Local\Temp\Ledger Live.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1768-0-0x000002267D3B0000-0x000002267D3C8000-memory.dmp
    Filesize

    96KB

    Download
  • memory/1768-1-0x00007FFFE5A23000-0x00007FFFE5A24000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1768-2-0x000002267F950000-0x000002267FB12000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/1768-3-0x00007FFFE5A20000-0x00007FFFE640C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1768-4-0x0000022618530000-0x0000022618A56000-memory.dmp
    Filesize

    5.1MB

    Download