Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 04:01
General
-
Target
Project Ligma.exe
-
Size
25KB
-
MD5
4b905d058730d8f822acb3c5403025b3
-
SHA1
8d42b34ac05c33a2785ce4294a23cff4c3b1c735
-
SHA256
56e006657d3057aa8853ae37f16bd07dd9467344190fabf6f809ae1c6bde56a0
-
SHA512
4d31828f8684d6492a501bf8205994db394de77ea0516720aa703a5968095e358b226b23060ae0243771867df01c71800697fdb610bf8c6620657757c54646aa
-
SSDEEP
384:BDzUkIdjc9kyecBWZNgTEp3trMrsNleNf88uuagE9WRPagdF9dofRmVukvwKwq6V:BVeiSv9Nlsf88uycYLd3dAcjq
Malware Config
Extracted
discordrat
-
discord_token
MTMxMjYwNjY0NDYwOTM1NTg2Nw.GmiBbD.BxOkmi6_jSm3KiEBfaoI7z9GP_TE4zxloC3fjo
-
server_id
1312606556201681018
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project Ligma.exe"C:\Users\Admin\AppData\Local\Temp\Project Ligma.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5047501531983682c470ca7560077477a
SHA199d90e9b66320b9c08e9633607f15743f7d4af7c
SHA256b3bf1cabe7e98e7120e69d3d5c63cea55dd9345aa9facae7a97a84134eaf1984
SHA51247e76b0d14c5d2f601b087413bfa9ba6a00ea11a9ec6666e4787c926b0a2df92da313ed4fe6736913d623de21683ea876006eb43d75a10cd5902be6a2b662bab
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
2.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
96KB
-
Filesize
5.2MB