Analysis
-
max time kernel
412s -
max time network
426s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
05-12-2024 18:20
Errors
Reason
Machine shutdown
General
-
Target
Hwid-Reset.exe
-
Size
78KB
-
MD5
a348a74758a190078c3c7ccf91739cf5
-
SHA1
6814404fb1919f7d9b28efc9037e7621766586be
-
SHA256
c2bc2b0bd8535ef0d0a3843445d7097ac9013c1f88f57250fbc6416cf844c67d
-
SHA512
65463579779cc0dc676f81b21b7bde1a3a2ac56e4de898894be56d6f258b1ca516f78391f9670df945aaefba88ca73fbb5b93a117119e9b8c4a6cd09378fefcd
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI3MDA0NjYxNjc1NzM0MjM4NA.GAoigp.OSXGR0km23KAfrelGjbo9d57ySstDsRwESCSE8
-
server_id
1314292708826943581
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hwid-Reset.exe"C:\Users\Admin\AppData\Local\Temp\Hwid-Reset.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB