Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    16/08/2024, 19:16

General

  • Target

    celestic.exe

  • Size

    78KB

  • MD5

    038faf7b553b5f29ebfa1c000ae225b8

  • SHA1

    de8dd46c92b81dc6e00d61e72612ba81e73a431e

  • SHA256

    ab89b88da095ccb90bfef2ca1bba709a28bdceceffc41241e21b8fc24ec68ef8

  • SHA512

    9c088f152fcf24993830e7696540afd2d50a6540a44f0d8584a5066a984b0e4f32bd0e60cfabadb9696ad048a5fc82616563639ab4bd7d75e75c606f394cca14

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI3NDA2MDk5NjEyMTcyMzAzMA.GU7_bO.PQQWKKCz2jDyxsje_hCfYCqcJYeKTnPTcs2E8I

  • server_id

    1274060797798252645

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\celestic.exe
    "C:\Users\Admin\AppData\Local\Temp\celestic.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1520 -s 600
      2⤵
        PID:3004

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1520-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

      Filesize

      4KB

    • memory/1520-1-0x000000013F920000-0x000000013F938000-memory.dmp

      Filesize

      96KB

    • memory/1520-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

      Filesize

      9.9MB

    • memory/1520-3-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

      Filesize

      4KB