Overview
overview
10Static
static
10Discord Ac...FS.exe
windows7-x64
7Discord Ac...FS.exe
windows10-2004-x64
7Discord Ac...or.exe
windows7-x64
10Discord Ac...or.exe
windows10-2004-x64
10Discord Ac...FS.exe
windows7-x64
7Discord Ac...FS.exe
windows10-2004-x64
7Discord Ac...ip.dll
windows7-x64
1Discord Ac...ip.dll
windows10-2004-x64
1Discord Ac...nt.exe
windows7-x64
10Discord Ac...nt.exe
windows10-2004-x64
10Discord Ac...er.exe
windows7-x64
8Discord Ac...er.exe
windows10-2004-x64
8Discord Ac...it.dll
windows7-x64
1Discord Ac...it.dll
windows10-2004-x64
1Discord Ac...ld.exe
windows7-x64
3Discord Ac...ld.exe
windows10-2004-x64
3Discord Ac...ts.dll
windows10-2004-x64
1Discord Ac...it.dll
windows7-x64
1Discord Ac...it.dll
windows10-2004-x64
1Discord Ac...ld.exe
windows7-x64
3Discord Ac...ld.exe
windows10-2004-x64
3Discord Ac...ts.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 22:53
Behavioral task
behavioral1
Sample
Discord Account Generator v2/AlphaFS.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Discord Account Generator v2/AlphaFS.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Discord Account Generator v2/DiscordGenerator.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Discord Account Generator v2/DiscordGenerator.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Discord Account Generator v2/RDXService/AlphaFS.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Discord Account Generator v2/RDXService/AlphaFS.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Discord Account Generator v2/RDXService/Ionic.Zip.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Discord Account Generator v2/RDXService/Ionic.Zip.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Discord Account Generator v2/RDXService/Jint.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Discord Account Generator v2/RDXService/Jint.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Discord Account Generator v2/RDXService/Launcher.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
Discord Account Generator v2/RDXService/Launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Discord Account Generator v2/RDXService/WPFToolkit.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Discord Account Generator v2/RDXService/WPFToolkit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Discord Account Generator v2/RDXService/build.exe
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
Discord Account Generator v2/RDXService/build.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Discord Account Generator v2/RDXService/rdpcorets.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Discord Account Generator v2/WPFToolkit.dll
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
Discord Account Generator v2/WPFToolkit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
Discord Account Generator v2/build.exe
Resource
win7-20241023-en
Behavioral task
behavioral21
Sample
Discord Account Generator v2/build.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
Discord Account Generator v2/rdpcorets.dll
Resource
win10v2004-20241007-en
General
-
Target
Discord Account Generator v2/AlphaFS.exe
-
Size
13.2MB
-
MD5
3a49c6ce407d3b7757c99bd6d6af8724
-
SHA1
0793415a29df3b80ed1652b804c142fd07432e73
-
SHA256
9bcf497f05bd39935654dc7b92af299794a3f6fad83a37f2fbfc097b664645c5
-
SHA512
8efeb1a4d77527d234a6777c8324f19a61d3a0f012d1171620ef240f24c076a503a3dfcdd91b7239e69b8e5554bea330e663773d8a6e38d485e0bc2b8fb60747
-
SSDEEP
393216:IVm9jIg3Mf+WJno10MzU1oFw4EHykhp3kWGCjuq:IV2W++oiMzQn1hZKCjuq
Malware Config
Signatures
-
Loads dropped DLL 37 IoCs
pid Process 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe 2612 AlphaFS.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 2612 AlphaFS.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2612 1776 AlphaFS.exe 31 PID 1776 wrote to memory of 2612 1776 AlphaFS.exe 31 PID 1776 wrote to memory of 2612 1776 AlphaFS.exe 31 PID 2612 wrote to memory of 1440 2612 AlphaFS.exe 32 PID 2612 wrote to memory of 1440 2612 AlphaFS.exe 32 PID 2612 wrote to memory of 1440 2612 AlphaFS.exe 32 PID 2612 wrote to memory of 1344 2612 AlphaFS.exe 33 PID 2612 wrote to memory of 1344 2612 AlphaFS.exe 33 PID 2612 wrote to memory of 1344 2612 AlphaFS.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord Account Generator v2\AlphaFS.exe"C:\Users\Admin\AppData\Local\Temp\Discord Account Generator v2\AlphaFS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Discord Account Generator v2\AlphaFS.exe"C:\Users\Admin\AppData\Local\Temp\Discord Account Generator v2\AlphaFS.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Discord Generator ^| coded by Nightfall#25123⤵PID:1344
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
87KB
MD58b40a68ae537c0aab25a8b30b10ab098
SHA11c8ac1f7f5c3697c457dd98f05296c2354ff7f55
SHA2560b86ef4810d53e79f1d934b427fdbacf3792eebb37ed241bc89148238af763fa
SHA512620ad61ff05c73adee4ac8f4b88a3880c11893eaac77ccca4e88edb29b492366a5bcf813d18628f005730f7e45ce373af9275776ea768b67b8d0e3bc62949229
-
Filesize
131KB
MD59a69561e94859bc3411c6499bc46c4bd
SHA13fa5bc2d4ffc23c4c383252c51098d6211949b99
SHA2566bbde732c5bcb89455f43f370a444bb6bca321825de56f9a1f2e947b0a006f1c
SHA51231d9e3844f1b8e72ec80acd1e224a94d11039c130e69c498a668e07e0d8bba8d1ed1ebe0b7a16376ca597d0e2b74a0d5e3bf53d1cbadf5bf099d3bf78db659a4
-
Filesize
38KB
MD51f77f7a5f36c48e7c596e7031c80e4ff
SHA179f86e31203b60b3388047e39a2a26275da411f5
SHA25630dfbd97883b1545513ca5bb857a9aad6e9bf4b8b4272569818346eaf25033f7
SHA512b647e820ae4854921839a6cc92610fd63ef79623d442fd17503a39ca145dfd6cde3719c50473c0c74fe487f980b12e90bd3d3beb5729fa5498a357d44f81809c
-
Filesize
251KB
MD516fb5a2363ce8dd12a65a9823a517b59
SHA159979d9195259f48c678cdaa36b5efee13472ff5
SHA256bb78ca0dd1478027e2e9f06f56fc7c3cc6f157b4151562d58a7f6646e463fcc2
SHA512d9801cdd8cc9809781b79882a226ee7a56d93eac0181295c80cb1f088f0fbf46e3eb35c7d8ff208dbd5a3e93a190a04c48fd254c9971a3740b020547973683e1
-
Filesize
74KB
MD50ea1df6137ee3369546a806a175aecf4
SHA195fd1ad45892cb9e655bfa62ca1be80a0b9b2d43
SHA2566fcc31573ae6b380db1d4e23731755465fd2cee0856e7a6c0e396759bcbf73b5
SHA5126497fdb86ac69f6551a7794c090ca695bf22eb647b7a503fa23d7944ad375f061429f17e2ea043c809460e7cb9fc3df77c7bfe0b64f00ddd65de1aa744d3adcb
-
Filesize
121KB
MD50e970f3353e65094165edcdfcaf1c299
SHA1e86d2c4723ae09890f69ab1a6f4a1a935dc0a0e7
SHA2564fed9f05da139d66e0582b47c20ee91c91be44d379c225f89b22462bedc989d3
SHA5124621d1add268f9aadf0119055d6cce23739eec969ab031fc0a510c40cf4cce60230a89735fd85c38f28c22ed9dc829ff294ef48590fc56191464e1fec1fa4595
-
Filesize
11KB
MD535bc1f1c6fbccec7eb8819178ef67664
SHA1bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA2567a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
SHA5129ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
-
Filesize
11KB
MD53bf4406de02aa148f460e5d709f4f67d
SHA189b28107c39bb216da00507ffd8adb7838d883f6
SHA256349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
SHA5125ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
-
Filesize
13KB
MD58acb83d102dabd9a5017a94239a2b0c6
SHA19b43a40a7b498e02f96107e1524fe2f4112d36ae
SHA256059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
SHA512b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
-
Filesize
11KB
MD59c9b50b204fcb84265810ef1f3c5d70a
SHA10913ab720bd692abcdb18a2609df6a7f85d96db3
SHA25625a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
SHA512ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd
-
Filesize
11KB
MD543e1ae2e432eb99aa4427bb68f8826bb
SHA1eee1747b3ade5a9b985467512215caf7e0d4cb9b
SHA2563d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
SHA51240ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b
-
Filesize
12KB
MD5031dc390780ac08f498e82a5604ef1eb
SHA1cf23d59674286d3dc7a3b10cd8689490f583f15f
SHA256b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
SHA5121468ad9e313e184b5c88ffd79a17c7d458d5603722620b500dba06e5b831037cd1dd198c8ce2721c3260ab376582f5791958763910e77aa718449b6622d023c7
-
Filesize
15KB
MD5285dcd72d73559678cfd3ed39f81ddad
SHA1df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a
SHA2566c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
SHA51284ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a
-
Filesize
11KB
MD55cce7a5ed4c2ebaf9243b324f6618c0e
SHA1fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3
SHA256aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
SHA512fc85a3be23621145b8dc067290bd66416b6b1566001a799975bf99f0f526935e41a2c8861625e7cfb8539ca0621ed9f46343c04b6c41db812f58412be9c8a0de
-
Filesize
13KB
MD541fbbb054af69f0141e8fc7480d7f122
SHA13613a572b462845d6478a92a94769885da0843af
SHA256974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
SHA51297fb0a19227887d55905c2d622fbf5451921567f145be7855f72909eb3027f48a57d8c4d76e98305121b1b0cc1f5f2667ef6109c59a83ea1b3e266934b2eb33c
-
Filesize
12KB
MD5212d58cefb2347bd694b214a27828c83
SHA1f0e98e2d594054e8a836bd9c6f68c3fe5048f870
SHA2568166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
SHA512637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe
-
Filesize
11KB
MD5242829c7be4190564becee51c7a43a7e
SHA1663154c1437acf66480518068fbc756f5cabb72f
SHA256edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
SHA5123529fde428affc3663c5c69baee60367a083841b49583080f0c4c7e72eaa63cabbf8b9da8ccfc473b3c552a0453405a4a68fcd7888d143529d53e5eec9a91a34
-
Filesize
20KB
MD5fb79420ec05aa715fe76d9b89111f3e2
SHA115c6d65837c9979af7ec143e034923884c3b0dbd
SHA256f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
SHA512c40884c80f7921addced37b1bf282bb5cb47608e53d4f4127ef1c6ce7e6bb9a4adc7401389bc8504bf24751c402342693b11cef8d06862677a63159a04da544e
-
Filesize
12KB
MD5dd899c6ffecce1dca3e1c3b9ba2c8da2
SHA12914b84226f5996161eb3646e62973b1e6c9e596
SHA256191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
SHA5122db47faa025c797d8b9b82de4254ee80e499203de8c6738bd17ddf6a77149020857f95d0b145128681a3084b95c7d14eb678c0a607c58b76137403c80fe8f856
-
Filesize
15KB
MD5883120f9c25633b6c688577d024efd12
SHA1e4fa6254623a2b4cdea61712cdfa9c91aa905f18
SHA2564390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
SHA512f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f
-
Filesize
17KB
MD529680d7b1105171116a137450c8bb452
SHA1492bb8c231aae9d5f5af565abb208a706fb2b130
SHA2566f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
SHA51287dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5
-
Filesize
17KB
MD5f816666e3fc087cd24828943cb15f260
SHA1eae814c9c41e3d333f43890ed7dafa3575e4c50e
SHA25645e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
SHA5126860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581
-
Filesize
13KB
MD5143a735134cd8c889ec7d7b85298705b
SHA1906ac1f3a933dd57798ae826bbefa3096c20d424
SHA256b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
SHA512c9abe209508afae2d1776391f73b658c9a25628876724344023e0fc8a790ecb7dbce75fddae267158d08a8237f83336b1d2bd5b5ce0a8eed7dd41cbe0c031d48
-
Filesize
11KB
MD56f1a1dfb2761228ccc7d07b8b190054c
SHA1117d66360c84a0088626e22d8b3b4b685cb70d56
SHA256c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
SHA512480b4f9179d5da56010fa90e1937fe3a232f2f8682596c16eeaed08f57cf8cffeaa506060429501764f695cb6c5b3e56b0037de948c4d0e3933f022a0b4103d2
-
Filesize
768KB
MD5eb723b4c1b48d3e8969ff3f4d897b79e
SHA1a03479e7a916d0ee5e3647322307aceb0b1c30b9
SHA256ed6356556e3a86b92f9995bce5b1c3182d5df8976a2ca2e400ebf4eaed592ef5
SHA5124c9902b5698e4e3d8837d594e337a6696ce03d9f6d0d3fc7f5f144c53c2fb7494ac10d303ea597c25c159076f74a7b7c59eb2d29db068878ab6f4bbb510fd13f
-
Filesize
3.2MB
MD5bf83f8ad60cb9db462ce62c73208a30d
SHA1f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e
-
Filesize
670KB
MD5fe1f3632af98e7b7a2799e3973ba03cf
SHA1353c7382e2de3ccdd2a4911e9e158e7c78648496
SHA2561ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
SHA512a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0
-
Filesize
3.6MB
MD586af9b888a72bdceb8fd8ed54975edd5
SHA1c9d67c9243f818c0a8cc279267cca44d9995f0cf
SHA256e11aa3893597d7c408349ebb11f47a24e388fd702c4d38b5d6f363f7ad6e8e5f
SHA5125d8fd9040f466e23af7f17772e3769ad83c5f55f8c70dcc3cfb1f827e105f0f4e6133f0e183fabc67dd44799495c47f931bf92546342b30b9c4a5c2b4aeee7c7
-
Filesize
136KB
MD577b6875977e77c4619bbb471d5eaf790
SHA1f08c3bc5e918c0a197fbfd1b15e7c0491bd5fade
SHA256780a72ba3215ff413d5a9e98861d8bb87c15c43a75bb81dc985034ae7dcf5ef6
SHA512783939fc97b2445dfe7e21eb6b71711aba6d85e275e489eddcc4f20c2ed018678d8d14c9e1856f66e3876f318312d69c22cee77f9105a72e56a1be4f3e8a7c2e
-
Filesize
26KB
MD5e1d0d18a0dd8e82f9b677a86d32e3124
SHA196a00541d86d03529b55c1ac5ff1c6cfb5e91d1e
SHA2564595675949851bd0ff65521e936647fcc5c8d2f32f0ac2641a262fb6323896dd
SHA51238e3b6b23ebcbdc60eeeed0bf3dddc69004a1ccd4a2486f3a9f8c0d4624b690e2e5704e3fe05bf1bf2c900bf4f5bc9439f45f3c02fd4c67783056b3da15e0f56
-
Filesize
6KB
MD5e6b3169414f3b9c47a9b826bb71a0337
SHA1d22278a492d03863ce51569482dcfb30a0b006e9
SHA2561198a9999dde24dd2da0d9877cc2e8f8dd70bfdaeee0b5012b24e5474b50e88c
SHA512bf9e48caf03e19274b5020d5eae6a3d6d75b611676f307346cf28117da71410e6022a72da0f82a8f2c6ca06a2c503c8e6528c6a164c4fb488c5195d6aa3e3819
-
Filesize
987KB
MD561eb0ad4c285b60732353a0cb5c9b2ab
SHA121a1bea01f6ca7e9828a522c696853706d0a457b
SHA25610521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
SHA51244cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d