Analysis
-
max time kernel
49s -
max time network
46s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15-07-2024 14:42
General
-
Target
redengine.exe
-
Size
78KB
-
MD5
d190aafd5cd1752db1815f4677088807
-
SHA1
262a4260a8acab24193f307c019104e83b30a858
-
SHA256
aa4fd9b40ed3ddf4cb2b38554a3ad0344e11c34a873273bdcfdb053cbbec5057
-
SHA512
4ea0399b0760e6d0a19ad2b15fbd27e21cd86dcd6c64994bbfc3f57a8eeef6a475a37fe9189b44e19b331d4422af7b11dc95f1e9337292ac137137e5f10e24f8
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPIC:5Zv5PDwbjNrmAE+7IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI2MjA0OTgwODEzOTQyMzc0NA.GaQfYG.7LGcj-W5XtFYi4iORWstYkVS-Wd--pdFC-lFPI
-
server_id
1262046756489793698
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 31 IoCs
-
Suspicious use of SendNotifyMessage 31 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\redengine.exe"C:\Users\Admin\AppData\Local\Temp\redengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.8MB