Analysis
-
max time kernel
134s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-12-2024 10:04
General
-
Target
MFjGBrO.exe
-
Size
475KB
-
MD5
cbe2f2a631cafa3abf6169b419e84dc5
-
SHA1
20ac6d8060f99f16a92db8aa55ddfb7b2f2997c4
-
SHA256
f23839bc1f59d1cd4c542169e22882ac68063a169ae6f3e25e82b91c5e300b58
-
SHA512
0f879a83e08f43576786fc5e561c73e1eeec0799574e5ba3018b88b96b1abbd177385f7b0b3db3d97fdf1328ec2b0813223ab725915eb57774362f868a076d1f
-
SSDEEP
12288:byveQB/fTHIGaPkKEYzURNAwbAg8FvKIfKJzHj:buDXTIGaPhEYzUzA0qJKIfizHj
Malware Config
Extracted
discordrat
-
discord_token
MTMxMDkxODg1Mjk4ODc2NDE4MA.GzBXeG.IQdsANXf5vF4yFt_OatJlXeGmRVH0AzHFLzfHw
-
server_id
1310919517383294990
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MFjGBrO.exe"C:\Users\Admin\AppData\Local\Temp\MFjGBrO.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\back.exe.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\back.exe.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x1541⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD53d44659c2dd4aa6c8dd0e21fd29769ab
SHA13e0724fc329780d69a92bd73919924f6234cd3fe
SHA2566795c0e852fa9d12ccd72e08bf0eb701a5f4f928cb72b6de61fe15d4a8fc20b1
SHA5121300172a2c87ec4d37db051f636c76042ace4556db84051ae61159e86f79acb4fd13268248bfe6b78198729b095a649a969a1e741d81e72fae9f1c29afcb41a3
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
2.8MB
-
Filesize
56KB
-
Filesize
680KB