Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/12/2024, 00:06

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    e431572cf9b2b7fa205908174a189995

  • SHA1

    cc335f1d3a8701f9ec56dbfa7bd998bf0834ace5

  • SHA256

    1f75d7db6a9ee6a068a658f9b15e4aac19869114e66471a98ed34ad889cedb45

  • SHA512

    1b0445a8d0d2f4fb5e19dcb2853481dc4402716064351f10a9fe910d9dad96396ae2ee901b3d9fae1e64569580dca53d0ad81b376bf24e34d95dac5976e6c543

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+3PIC:5Zv5PDwbjNrmAE+/IC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMxNjkxMTAxOTExNjg1NTMwNw.GgsF1U.6l0gW_pEduuRrYaUh7Lx4wfPIRQziNd8029Pvg

  • server_id

    1310339166193582120

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3268-0-0x00007FFBC4243000-0x00007FFBC4245000-memory.dmp

    Filesize

    8KB

  • memory/3268-1-0x000001510EAE0000-0x000001510EAF8000-memory.dmp

    Filesize

    96KB

  • memory/3268-2-0x0000015129120000-0x00000151292E2000-memory.dmp

    Filesize

    1.8MB

  • memory/3268-3-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

    Filesize

    10.8MB

  • memory/3268-4-0x0000015129A20000-0x0000015129F48000-memory.dmp

    Filesize

    5.2MB

  • memory/3268-5-0x00007FFBC4243000-0x00007FFBC4245000-memory.dmp

    Filesize

    8KB

  • memory/3268-6-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

    Filesize

    10.8MB