Analysis
-
max time kernel
437s -
max time network
1784s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
30-09-2024 18:32
General
-
Target
adfcgnp.scr
-
Size
444KB
-
MD5
f2669c6d375bfd12168b500f96c0a756
-
SHA1
0dc9821912eedafafd9b2f9f4552f2b374924da0
-
SHA256
11e0b8fd4dbe45946584c067767bee27a362f01b1262adcc927dc396c5ede806
-
SHA512
f71bf36aff4db52f1c5d4cdf8004272571d228482a853bf90ccb954973bbedbe8a10818848a69de3e0d4870356bd01c0276c918f3be1ceb9e8007adbce015542
-
SSDEEP
12288:ntH5NLaAdDhAAEIFcWX+t4o+QMIUYUD6A+rSXH6P:ntH5sAdXEIFcUo+fDQrKH6P
Malware Config
Extracted
discordrat
-
discord_token
MTI4OTcwNjgwMDE5MDU4NzA0MQ.GLPbKO._bSSJm0gQWkbYqibHsDuqzcfNGezAcMtUoJS2g
-
server_id
1162176704329027645
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\adfcgnp.scr"C:\Users\Admin\AppData\Local\Temp\adfcgnp.scr" /S1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Roblox.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Roblox.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Roblox.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\RarSFX0\Roblox.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD552298de2a7a73b26514ffb92056ad6ae
SHA10338395566b8e97f5e78d1c7d1275516a5413da4
SHA2562fcac49523c1dafb154b519599d00c9afa9df4bb0e6bb61f8fa887bbb8985e82
SHA5120ab3c723127dc837033eafa608fc306cdc7e6fb0767018f585fced51a3c90808fdfedb79c404e283418f4b9adf1dff9e1cb455369dd0fb90245772232a31785e
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
2.8MB