Analysis
-
max time kernel
26s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
11-11-2024 03:36
General
-
Target
e0f3358ba194d38383fad9c02c67c74db0de2b1de62031bcca475f4e58154d9b.exe
-
Size
3.5MB
-
MD5
b659ae263510522b8d1bbc2c843a59aa
-
SHA1
a8cb4eeaed0c678f070573258ba766bf2ff3bf99
-
SHA256
e0f3358ba194d38383fad9c02c67c74db0de2b1de62031bcca475f4e58154d9b
-
SHA512
c9a8dd1d6a6b2bf4d5553efafc0e3b864141443d7914cb71cf9c8b96ed45787d06bef0a4d41b6dcdf0ebcf400c2c0e6890a70964404a4977d7b26cb75436793d
-
SSDEEP
49152:wDjlabwz9WftVELfwDeMwHJ0n/QBQqlxCCBfjASi93532w+eAWsQQpOpydN0FWVu:QqwYfYq4zlpfjS1MWsjcWNp9tn38f
Malware Config
Extracted
discordrat
-
discord_token
MTMwNTIzNjAyOTQ0MzQwNzkyMg.GruaeT.YnRJjugEne-8ueplgAjqzDORIFDIjXMQyzKlZ4
-
server_id
1305235751331430410
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 10 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0f3358ba194d38383fad9c02c67c74db0de2b1de62031bcca475f4e58154d9b.exe"C:\Users\Admin\AppData\Local\Temp\e0f3358ba194d38383fad9c02c67c74db0de2b1de62031bcca475f4e58154d9b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2520 -s 5963⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Roblox.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Roblox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-b7eebc919e96477a\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Temp\EU2923.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU2923.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD52e050c1109eff187bd3116a9b4889fae
SHA15e3f61c75167f7c60a9cf9f39c419d498d7028a7
SHA2561a48ea95cf69095d0402221a3694d985e12b6cb6fe938a32f029278198c3f85d
SHA512ecf56ac20bb2e8df9eefd49785354bf5395943dfbdbef54187b5e202d24a5e8a55f147baea8dc70b69b73fb7c8eafb3082b56ec0cc4d72f9880ff9c58c8f9c4e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
6.7MB
MD57203cce6d4862929a7e29350acfc01a9
SHA13f24c3fe84bbe6d446bc96f1f000347517e46541
SHA256874b8d538afd95fec999ba0e9151aaad9a8377929cc190d8a41ac3965461bf91
SHA512e84419e12340f864b0f067cdd3edb7fc2de6e4a0386e9b135d6c5cc754462e0f59c077d812867abb5cac4ff2b314994611737440c86b2497fd4328c176eaea91
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
6.7MB
MD5b68e7f7ae52ef8e962723c7ddda4f75d
SHA1686bdf2057cdd7b16877fb5eec0aff150fa074d0
SHA256d779b2acc52b4b3e72c1461dbc7e950f0b650e924b3799db425942f64624e94d
SHA512cb0ecf531c95d657019b0188e648520b36b8386516d2e640239d99972ae44439d21ec6fcbe7902fc59c6f65db3571db0944e48f2207a442f3be5d10c9655bbb1
-
Filesize
1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
337KB
MD5bebf4bf762f1146dad09d8a29d8f23af
SHA1c61586bc0e76a1d56a20d4eca6c210095c36e812
SHA256c258492e66964f5ed8ccfed9b57b49a9f5b109586950baf13609800bb3eaed4d
SHA512af2f864253f50c8fbea9d307dfdb3c1b067fc86f52528ce8fe053b1692ead216de86239303542e99bf13ddbd97c0457bd6adfbb38f03a24676a20fb1ba5591ed
-
Filesize
4KB
-
Filesize
352KB
-
Filesize
9.9MB
-
Filesize
9.9MB