Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 05:05
Behavioral task
behavioral1
Sample
Run.exe
Resource
win7-20240708-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Run.exe
Resource
win10v2004-20240802-en
5 signatures
150 seconds
General
-
Target
Run.exe
-
Size
78KB
-
MD5
af4b2ac80f5f1cdf5b67fb87918fa8f6
-
SHA1
2d9a85401738144e01000a11d5ad16534dd7703a
-
SHA256
0d12c936747a895675c12ae53af28352bc8a1c6fdec16aa4abf35499e5c86b94
-
SHA512
6f9e4c481ac8678e14ce38b61c5108efade109a03b39330018bd7d3deb9a562abd89bce8ec0a60ec7ee5da592e9158f88d5a7b805997d3515b9e3d2797c2c59e
-
SSDEEP
1536:P2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+VPIu:PZv5PDwbjNrmAE+FIu
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI4OTA4NDQ4NjAxNzA5MzY1Mg.GU9sth.3N0tTy7lqu3KMV6HV1In6GWJPFUNSX5TtpGqBs
-
server_id
1289039707686178857
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2396 2568 Run.exe 30 PID 2568 wrote to memory of 2396 2568 Run.exe 30 PID 2568 wrote to memory of 2396 2568 Run.exe 30