Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 07:08

General

  • Target

    Discord Nitro Generator.exe

  • Size

    2.0MB

  • MD5

    26aade362e76606a6dd64b1783d989eb

  • SHA1

    feefb270d825aa93a0c249db479bc3308f7a4b5f

  • SHA256

    d235cc33d4a1bad720e4de5e3748ffadc760cfb73326767473e2cb86d1afa3d6

  • SHA512

    2fd7b9ad727dce7a689199f0eac2b6eb6873b8a676a531e2732a94c28e3d20dc19b94ad78efa37db7e5a485adbfb1044e65092f97fe57f3ca4d0cd64ae507a14

  • SSDEEP

    49152:EQ+UdDEITs0m3KMtun3fDokUdlzWsYNZXPL0yJTEx+F:BLNVTsPG0k49WPNZXTw8

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 17 IoCs
  • Sectoprat family
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.exe
    "C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/748-0-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-1-0x000000007F830000-0x000000007FC01000-memory.dmp

    Filesize

    3.8MB

  • memory/748-2-0x000000007464E000-0x000000007464F000-memory.dmp

    Filesize

    4KB

  • memory/748-3-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-4-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-5-0x0000000006C40000-0x0000000007258000-memory.dmp

    Filesize

    6.1MB

  • memory/748-6-0x0000000006660000-0x0000000006672000-memory.dmp

    Filesize

    72KB

  • memory/748-7-0x00000000066C0000-0x00000000066FC000-memory.dmp

    Filesize

    240KB

  • memory/748-8-0x0000000006700000-0x000000000674C000-memory.dmp

    Filesize

    304KB

  • memory/748-9-0x0000000074640000-0x0000000074DF0000-memory.dmp

    Filesize

    7.7MB

  • memory/748-10-0x0000000006960000-0x0000000006A6A000-memory.dmp

    Filesize

    1.0MB

  • memory/748-11-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-12-0x000000007F830000-0x000000007FC01000-memory.dmp

    Filesize

    3.8MB

  • memory/748-14-0x000000007464E000-0x000000007464F000-memory.dmp

    Filesize

    4KB

  • memory/748-13-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-15-0x0000000074640000-0x0000000074DF0000-memory.dmp

    Filesize

    7.7MB

  • memory/748-16-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-17-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-18-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-19-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-20-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-21-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-22-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-23-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-24-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-25-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-26-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-27-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB

  • memory/748-28-0x0000000000170000-0x0000000000A8E000-memory.dmp

    Filesize

    9.1MB