Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/10/2024, 22:45

241010-2prxeswcmj 10

10/10/2024, 22:13

241010-15bppsvcqj 10

Analysis

  • max time kernel
    570s
  • max time network
    570s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 22:13

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    e8e307d2a0e8b33878dea7396f1fe7fe

  • SHA1

    4abea5f3288c4045a68d2d355838533d72768e69

  • SHA256

    0a188431ec4ef4275ebe8377963a65e82d9a1fbc9a72c9047ccc6fe65d30b837

  • SHA512

    c8b50c57b9ac2c3a73a8256a85b74d8ab599c5415148f48ee902f0965bd0c2e7fa91756cd12f491be093058fbf57cb20fca59bd71303147ebbbb36515b82f774

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI5NDA0NTgxMjIxMjQ5ODQ1Mg.G2NcYi.AGgJbkkw4ihNbkFwsXZwuwi-qjW6NEuR8lVozM

  • server_id

    1294045594666668093

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 39 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:872
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x514 0x49c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4996
  • C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe"
    1⤵
      PID:4536
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
        PID:1356

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_1FE66027A63A4EA69EA648B47B395E92.dat

        Filesize

        940B

        MD5

        8a97e23c64413b84fe3a3e6f7dedf0bb

        SHA1

        3f47b588eedcc43f60ca37d3b5531abc8c83636e

        SHA256

        26f06d63a2f25d68893e0380c3492569b8a1b089b3132a749bb9ba900fac9140

        SHA512

        8ca8cf6005bfa3ccb3c2b8deda425cca928e210072ccf6ae409bd55eb3561e0cfdaa47786c4c764dbfb785bc1af9755a51bd6c16c2eee7c2915dca7e5256613d

      • memory/872-6-0x0000024DA07D0000-0x0000024DA07E2000-memory.dmp

        Filesize

        72KB

      • memory/872-8-0x00007FF993183000-0x00007FF993185000-memory.dmp

        Filesize

        8KB

      • memory/872-3-0x00007FF993180000-0x00007FF993C41000-memory.dmp

        Filesize

        10.8MB

      • memory/872-4-0x0000024DBB280000-0x0000024DBB7A8000-memory.dmp

        Filesize

        5.2MB

      • memory/872-5-0x0000024DBAD50000-0x0000024DBADC6000-memory.dmp

        Filesize

        472KB

      • memory/872-0-0x00007FF993183000-0x00007FF993185000-memory.dmp

        Filesize

        8KB

      • memory/872-7-0x0000024DA2260000-0x0000024DA227E000-memory.dmp

        Filesize

        120KB

      • memory/872-2-0x0000024DBAB80000-0x0000024DBAD42000-memory.dmp

        Filesize

        1.8MB

      • memory/872-9-0x00007FF993180000-0x00007FF993C41000-memory.dmp

        Filesize

        10.8MB

      • memory/872-10-0x0000024DBAEF0000-0x0000024DBAF9A000-memory.dmp

        Filesize

        680KB

      • memory/872-14-0x00007FF993180000-0x00007FF993C41000-memory.dmp

        Filesize

        10.8MB

      • memory/872-15-0x00007FF993180000-0x00007FF993C41000-memory.dmp

        Filesize

        10.8MB

      • memory/872-1-0x0000024DA0380000-0x0000024DA0398000-memory.dmp

        Filesize

        96KB

      • memory/872-20-0x0000024DBAB70000-0x0000024DBAB7E000-memory.dmp

        Filesize

        56KB