Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/10/2024, 17:18
General
-
Target
Vape.rar
-
Size
2.5MB
-
MD5
f293cddf279b713755e7112f489536c2
-
SHA1
5b99ba528002fa724e3248d33a2f67488f5e9d68
-
SHA256
c5a936b546d48b39e1fbc7f535ea25d7e969889d0a3b6b860fb71a3576e04419
-
SHA512
a6f1402a63ef36342d802def82c4da1efe15818cc0f8437c0558c8c7ed26a2b31e586f069beab6559fd697affdf156b8617e3fd093f3aafe42ef513c28ee94ce
-
SSDEEP
49152:pAkSY6gUGWjW0Uu9hgx/zWafAZjqTAJc7Z2:pH6g3WKCafAfJn
Malware Config
Extracted
discordrat
-
discord_token
MTI5Mjk3NzAzNDk0MzAwODg5MA.GUtIvD.vaGauQAWYFeLWJRnUaocQs4q3Ztcew_JgOoy8U
-
server_id
1292965909807501376
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Executes dropped EXE 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Vape.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Vape\injector.exe"C:\Users\Admin\Desktop\Vape\injector.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5691c8bfc9e0c88048e673958036b4521
SHA1f5d8391530f31b5540dd6fefac179061ea44f366
SHA2562e4f54bd9589e135c3a489af339ad06bd4843a32ac0ea44115ecde240a41b510
SHA512cb9bda3900576e8af500eaf61e812b87a443964a47ac8d6ec0696b6a32774150800da09dd84b9810b532152d0292878e5ed4e9cdaf86509ac8162e2e759f230d
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB