Analysis

  • max time kernel
    98s
  • max time network
    112s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    16-12-2024 04:34

General

  • Target

    AIMr.exe

  • Size

    78KB

  • MD5

    67e0e6dc1dab2b50e036948470c1bf5f

  • SHA1

    f77d90748617aa516d95f06a6ef4fa511d9739fe

  • SHA256

    07c46b658c76254d83cccd35b28ee12f948ec01b1e24b12eefe4d93752ddb8a1

  • SHA512

    76b30103fa0612c11044543d5be4e36ad0340a3f1cdf91955e01911e886b427302dfa56972d9c9e554df8fbd30ae22b48293bd52241215df36a82022aea6959a

  • SSDEEP

    1536:F2WjO8XeEXFd5P7v88wbjNrfxCXhRoKV6+V+rPIC:FZz5PDwbjNrmAE+DIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    ODgxNzQzODc5NTAwNTk5MzM3.Gz4jXn.nabvUjO4zX_jYK_mdMBrfdMRfCB5q240mJH-vo

  • server_id

    1310387822045171713

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\AIMr.exe
    "C:\Users\Admin\AppData\Local\Temp\AIMr.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/624-0-0x00007FFF2A803000-0x00007FFF2A805000-memory.dmp

    Filesize

    8KB

  • memory/624-1-0x000001CA6EBB0000-0x000001CA6EBC8000-memory.dmp

    Filesize

    96KB

  • memory/624-2-0x000001CA71260000-0x000001CA71422000-memory.dmp

    Filesize

    1.8MB

  • memory/624-3-0x00007FFF2A800000-0x00007FFF2B2C2000-memory.dmp

    Filesize

    10.8MB

  • memory/624-4-0x000001CA71A60000-0x000001CA71F88000-memory.dmp

    Filesize

    5.2MB

  • memory/624-5-0x00007FFF2A803000-0x00007FFF2A805000-memory.dmp

    Filesize

    8KB

  • memory/624-6-0x00007FFF2A800000-0x00007FFF2B2C2000-memory.dmp

    Filesize

    10.8MB