Analysis
-
max time kernel
198s -
max time network
199s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
25-09-2024 23:31
General
-
Target
DiscordIP_Puller.exe
-
Size
858KB
-
MD5
09893350bce547088d0786e8dd187e68
-
SHA1
0cf7701bee198c69265bcef41158cac36b2a77ef
-
SHA256
6a4bf0a4ba8d3bc2378a1965ecc6216effb2731ca2ba897147228474b59e208d
-
SHA512
b6ca519711cd1c10a8f3fb15b84d7a65799cbad8afa03601b4526751b8885045e25c473a32430e4028fb08a3fcf367f1b636e8a503c5a6108ff1e3a982af050b
-
SSDEEP
24576:vRt1P8oIPyBSn6TsUqpTSXxySn6LOG6srt:vZMPWSnvPsxrn6q2rt
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiscordIP_Puller.exe"C:\Users\Admin\AppData\Local\Temp\DiscordIP_Puller.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
880KB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB