Analysis Overview
SHA256
abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e
Threat Level: Known bad
The file abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e was found to be: Known bad.
Malicious Activity Summary
Discord RAT
Discordrat family
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2
Unsigned PE
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-02 01:49
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-02 01:49
Reported
2025-01-02 01:52
Platform
win7-20240903-en
Max time kernel
122s
Max time network
124s
Command Line
Signatures
Discord RAT
Discordrat family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe | N/A |
| N/A | N/A | C:\Windows\system32\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\system32\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\system32\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\system32\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\system32\WerFault.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe
"C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe"
C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2868 -s 596
Network
Files
memory/2108-6-0x0000000003210000-0x0000000003220000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe
| MD5 | 54e9187948f4a9b41bd59d9fd635eecc |
| SHA1 | 035ad8b616219217759da98bf1389cdbd9b61f5c |
| SHA256 | bc2103c84955d2046cc1c8460f6ed28de8739cbb21143cae612c5b8ef31ea63e |
| SHA512 | 452be3bd85e93e005c406c0b9998c8c92e0ce6b38538d22d48a307f3496872a8a4d1542ee16c210cac5a0d86c391081c892ff657b2351a5c72b756241c1f58ea |
memory/2868-13-0x000007FEF5323000-0x000007FEF5324000-memory.dmp
memory/2868-14-0x000000013FFC0000-0x000000013FFD8000-memory.dmp
memory/2868-19-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp
memory/2868-21-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-02 01:49
Reported
2025-01-02 01:52
Platform
win10v2004-20241007-en
Max time kernel
99s
Max time network
149s
Command Line
Signatures
Discord RAT
Discordrat family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1784 wrote to memory of 3604 | N/A | C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe | C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe |
| PID 1784 wrote to memory of 3604 | N/A | C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe | C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe
"C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe"
C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 162.159.134.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | 234.134.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | geolocation-db.com | udp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 8.8.8.8:53 | 232.135.159.162.in-addr.arpa | udp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 253.102.89.159.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.130.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe
| MD5 | 54e9187948f4a9b41bd59d9fd635eecc |
| SHA1 | 035ad8b616219217759da98bf1389cdbd9b61f5c |
| SHA256 | bc2103c84955d2046cc1c8460f6ed28de8739cbb21143cae612c5b8ef31ea63e |
| SHA512 | 452be3bd85e93e005c406c0b9998c8c92e0ce6b38538d22d48a307f3496872a8a4d1542ee16c210cac5a0d86c391081c892ff657b2351a5c72b756241c1f58ea |
memory/3604-16-0x00007FFEF0B43000-0x00007FFEF0B45000-memory.dmp
memory/3604-17-0x000001D0BE160000-0x000001D0BE178000-memory.dmp
memory/3604-18-0x000001D0D88C0000-0x000001D0D8A82000-memory.dmp
memory/3604-19-0x00007FFEF0B40000-0x00007FFEF1601000-memory.dmp
memory/3604-20-0x000001D0D9200000-0x000001D0D9728000-memory.dmp
memory/3604-21-0x00007FFEF0B43000-0x00007FFEF0B45000-memory.dmp
memory/3604-22-0x00007FFEF0B40000-0x00007FFEF1601000-memory.dmp