Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Discord Nitro Generator.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
Discord Nitro Generator.exe
-
Size
2.0MB
-
MD5
26aade362e76606a6dd64b1783d989eb
-
SHA1
feefb270d825aa93a0c249db479bc3308f7a4b5f
-
SHA256
d235cc33d4a1bad720e4de5e3748ffadc760cfb73326767473e2cb86d1afa3d6
-
SHA512
2fd7b9ad727dce7a689199f0eac2b6eb6873b8a676a531e2732a94c28e3d20dc19b94ad78efa37db7e5a485adbfb1044e65092f97fe57f3ca4d0cd64ae507a14
-
SSDEEP
49152:EQ+UdDEITs0m3KMtun3fDokUdlzWsYNZXPL0yJTEx+F:BLNVTsPG0k49WPNZXTw8
Malware Config
Signatures
-
SectopRAT payload 17 IoCs
resource yara_rule behavioral2/memory/748-3-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-4-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-11-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-13-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-16-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-17-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-18-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-19-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-20-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-21-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-22-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-23-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-24-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-25-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-26-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-27-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat behavioral2/memory/748-28-0x0000000000170000-0x0000000000A8E000-memory.dmp family_sectoprat -
Sectoprat family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe 748 Discord Nitro Generator.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Discord Nitro Generator.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 748 Discord Nitro Generator.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 748 Discord Nitro Generator.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.exe"C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:748