Analysis

  • max time kernel
    7s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/12/2024, 08:50

General

  • Target

    cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe

  • Size

    588KB

  • MD5

    1cc6d8b0062bd2cba1276ed67bf35c06

  • SHA1

    f5fe59b1380d6d2b96d6abd92b27db0d19b92d17

  • SHA256

    cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0

  • SHA512

    22da4edd15adb6c73abcc15afe732b7423521cfb1dff1980258bcd7a11a9343a9dce248222d3fa280ae521f5e72beb13f2c19be91c9b54cc86124b006550ae6d

  • SSDEEP

    12288:ayveQB/fTHIGaPkKEYzURNAwbAg8gGQL0mSCcjTIVWdHr7:auDXTIGaPhEYzUzA0qv40mU0VYHr7

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMxODE4MTE0OTg3NjQyNDc3Nw.GQG8E9.nJeLLo161XgHRqOZobXXNSZwDQZ2I4osCosf_4

  • server_id

    1318182170891911208

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe
    "C:\Users\Admin\AppData\Local\Temp\cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\uno.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\uno.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\uno.exe

    Filesize

    78KB

    MD5

    450ecba1d1abd697740b513f1675d9b2

    SHA1

    985044a625d50042ca4d5829d93e2a3115278fd4

    SHA256

    665953beb4bf982b9f83d0f08953ade12a59504053b1c11b3672400cd26963ad

    SHA512

    47e20e979b1732ade07917126cd099ae538abf63d8bfada181705572d1e2dc492d99206aaacbddb31186da1cf5f306547a41bed205eeb1c6df6f0d53bb2db198

  • memory/4484-14-0x00007FFA99D03000-0x00007FFA99D05000-memory.dmp

    Filesize

    8KB

  • memory/4484-15-0x000001A581C70000-0x000001A581C88000-memory.dmp

    Filesize

    96KB

  • memory/4484-16-0x000001A59C2F0000-0x000001A59C4B2000-memory.dmp

    Filesize

    1.8MB

  • memory/4484-17-0x00007FFA99D00000-0x00007FFA9A7C1000-memory.dmp

    Filesize

    10.8MB

  • memory/4484-18-0x000001A59CAF0000-0x000001A59D018000-memory.dmp

    Filesize

    5.2MB

  • memory/4484-19-0x00007FFA99D03000-0x00007FFA99D05000-memory.dmp

    Filesize

    8KB

  • memory/4484-20-0x00007FFA99D00000-0x00007FFA9A7C1000-memory.dmp

    Filesize

    10.8MB