Analysis
-
max time kernel
166s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 23:12
General
-
Target
cleangnp.exe
-
Size
618KB
-
MD5
8b948933b21a7dd25cc33d9f6b3447c3
-
SHA1
0a8d15db88452a429b56f17e238ddce2a21b3f43
-
SHA256
77e7b02a53f97e11d03a6940fcc19a88ba209fc8b68808e2fe3c0af1ccf420b7
-
SHA512
7365e471018ea79830ce390bdb9be0fd35db7e70177b7cad7f9405986a748637ea91c11c2f32f252aa4ec1d884c611afdce00b800adc53252a4ec94bb6d53c61
-
SSDEEP
12288:nyveQB/fTHIGaPkKEYzURNAwbAg8Poc1Z8ussuYt7We8TFenrLSV0JsvC:nuDXTIGaPhEYzUzA0qwcuU8xenrV
Malware Config
Extracted
discordrat
-
discord_token
MTI5MzcwODM2NDc0ODE2MTAyNA.G0Wnp_.qVTNSpK-sScLmXdgwlSHCOmqRogcTbVxef1qu4
-
server_id
1293707853391204382
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cleangnp.exe"C:\Users\Admin\AppData\Local\Temp\cleangnp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\icon.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\icon.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD563544cc8cff3d6db6ac00399d20b8c77
SHA160cb0ae7613457fd97606d205e98af7bc066880f
SHA256690c32c72d0a9e0127376a4a7dfb561534dba9b1a8601bee3990231f13c88efd
SHA512865d7d12f58baf1a3f8f56f1551a2957dfa4d778c48f13487cf204015dc52e5cf278599ee3166b7ea190721ffc760f7c0f3713f646ded6c5a5e27b409e14d25e
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
56KB