Analysis
-
max time kernel
343s -
max time network
358s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
19-09-2024 16:46
General
-
Target
release.zip
-
Size
445KB
-
MD5
3d60e67d6e8740d413ee1574374609e1
-
SHA1
c65e926478a7fcae72d21f22ef3b9b16a61ca55c
-
SHA256
f2a004514d969a0fd51adc95623168d8ea37c7a7eae79f8418fd369c35a33134
-
SHA512
e43460aa06355e582c6b10fb1979d0b0d1ff96693912954f8b7fe03eb6839a3af03d1d467268bf76c20a8284b79f9c84590bdf542625e813d1a9cfac04aecde2
-
SSDEEP
12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQt:BKGo8EifSQwYWt
Malware Config
Extracted
discordrat
-
discord_token
MTI4NDkyOTc4ODgxNzA1MTY5OQ.GwuZFh.iY1N7R4WhPj51m4l9SuMbdoAQpu7KV57AHpfaY
-
server_id
1286366896802758667
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\release.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\release\token.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\release\builder.exe"C:\Users\Admin\Desktop\release\builder.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\release\Client-built.exe"C:\Users\Admin\Desktop\release\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD58bae102fb9fa9317afb3c0d4737bf0c4
SHA19c106d96cbf85cdca731cf9fd1aad6b00e0577cb
SHA2563523428d1725887634a5f75f9acd95c5e133144103f30090560dcfbc25cd9da4
SHA5121fabc8462adc6e2686141ebc7fdc631091ae3250711b288906332be86853acfbefd5bc15d2bc5f56b8b95840ccb8dc1a669a946d0537222012d8351899c3750a
-
Filesize
32KB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
1.1MB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
5.1MB