discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0?tab=readme-ov-file

Analysis

max time kernel
389s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/moom825/Discord-RAT-2.0?tab=readme-ov-file
Sample250102-htw76askdl

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyNDI3MTg2NTcxNTQ5NTAyNA.GX8wN6.8fxibMCSAV3dBk-DhXA_bbV0r_juEKWF6sbqO8
server_id
1305708687871971379

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 2 IoCs

pid	Process
4772	Client-built.exe
1568	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
104	discord.com
105	discord.com
98	discord.com
99	discord.com
100	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
1784	msedge.exe
1784	msedge.exe
4928	identity_helper.exe
4928	identity_helper.exe
5036	msedge.exe
5036	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	Client-built.exe
Token: SeDebugPrivilege	1568	Client-built.exe
Token: SeShutdownPrivilege	4772	Client-built.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3400	1784	msedge.exe	83
PID 1784 wrote to memory of 3400	1784	msedge.exe	83
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3536	1784	msedge.exe	84
PID 1784 wrote to memory of 3988	1784	msedge.exe	85
PID 1784 wrote to memory of 3988	1784	msedge.exe	85
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86
PID 1784 wrote to memory of 3632	1784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/moom825/Discord-RAT-2.0?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeffe546f8,0x7ffeffe54708,0x7ffeffe54718
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10357023223262993864,3036062377680201795,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2896

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3520

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
MD5 b8880802fc2bb880a7a869faa01315b0
SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
MD5 ba6ef346187b40694d493da98d5da979
SHA1 643c15bec043f8673943885199bb06cd1652ee37
SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 04ce22ba0b3fbfbfe0ef53ad06fefa4d67828e6460053e0f8fdca3cb9d37177d
MD5 1d4dd4b5bbfbff78140ec07311aae35f
SHA1 9153e32c0cc438998d76c47390cdbbebcd2de24d
SHA512 4cf340be9eb786ef359a5f95b93b005d979c5758bdbbf6422ce7a37aa07508cc8633947e7aa38e0de6c8066b7a942aacc6b44de92b108fb829e425eb0afcfdfc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 496B
SHA256 687af005a9ffb7618a8ee6e2af69b41ba02cb3f24d7262c1417f9677eadf1d80
MD5 33fc6f377130d6f3c13e931381c9938e
SHA1 c207a7edc2d704524d91a4c5542df3ef466e3ba9
SHA512 cecb614b3c4a89e23a98b5724c2b92d59e4e8df2f2780062634279ca82b0f9ff305abda9016815c5b723efc97d037368f5aeb7a701fe499da163e5b74f3fe4f4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 870cf06bf70e95e88a8a90fc14e1123585a1ac95f8b42378e5054b5ab2285dba
MD5 61558aeafdacb2024b8d898bdb225f77
SHA1 ccb51e09c4f5400e0e303fb83add1ae56d867672
SHA512 a60bcbbabf78f44b28665068e2b9b92c95d13fea45bcf3c7f094b88820c5fe519fd41c4378a818b476e1e81d8002f9533d16bb364c4b3318cde1da852aaab423
SSDEEP 96:nLktS/1JMFwpvWMoiVmdeHAnKeEUWQyV+VDCziEwb:nLkKjMFGWMXGKPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f64181d3608e5b4bf9118dbf1be54e585a68d9a8205d5c6ad7b00fb0eda96244
MD5 c5f5174d135b02742b76cb8c8f051c57
SHA1 f0d750666683aa6bdb7b9f2a726886323abb2ffd
SHA512 c732ec6619a20c0ce93ae42457fac8c2aa3182034fe9c38d3cae6d91e660493262667f3b8d4e7dbed4c4356a087ff6470203ca19b24762995a1c61ea290c1560
SSDEEP 96:nLk3S/1Z8FwpvWMoiVmdeJqur1jAnKHFEUWQyV+VD7AiEwb:nLk4/8FGWM5qurhGKHKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 09f7c80ad90914e8311fd428893689cc00988347d333129a8a2c505a5b491bdf
MD5 dc71fa50fbd57277f577fd2545263973
SHA1 76ee0adad307209e14674e1f6e08592aed2815d9
SHA512 73c2673044e0858d3b9b8bd2469aa6f3fdd520cc1828f568adf2e9d805aa403333eeac80a862adf2ede883e68f6adaaa5e423b3e6692631c9e43043b6e3db6bb
SSDEEP 96:nLk8sQ1S/1Z8FwpvWMoiVmdeEPw12jNAnKqcfUWQyV+VD7AiEwb:nLk1/8FGWMcwApGKVrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 6310ea17012a10e6f0132ec8864bc0f9ffc8af53a28b1146ffa7c108b1589782
MD5 818c4ee783973cd429a85c0d38be32f4
SHA1 b8712dd2c99139060d631f6cb6fbdffc4eeb9ed6
SHA512 a6f1e06463bef6196c6e16f6fd7d0e554ca631ce052b51267d9ebb5c6af803bb3626e9a37e6c0421339481d491c98ebcf09a7d56f2abcc59e22c9159c51b6355
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 2b97549542a5af612b5301cdfede69f0bc0a61d33e2a6606ee2a91dbc112b46c
MD5 6449b1e28dabd2c63f78e3e5e2cedda2
SHA1 99e9aecae54966e0143ccf9143b8b39c2d2b98f8
SHA512 a071a5c3b263c944ce60b71d8fc803eb3c6ade4bc83305cc699e0e64b66d7cd5655300c2e2b58ab57a8d3849bb833a604e5f18aef0b4464e18cf29600ffbea39
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5811dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5811dd.TMP
Size 874B
SHA256 f314a9178529a9c3a6df0d79054713dad600796b64990a560d653851eb8167ce
MD5 fe1ee1380e9049792fe77ddea202240f
SHA1 38ab4577f6e965bd00891e28f2fe4b454671f8d2
SHA512 7e4eda11606dbc2e116eb19d82b556593b1a3fab4c3d2d94a1634f863e7d6cba65959629c4702f469ff619edd1200813a243a73ee25bf386188da8d9e9c97644
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 45c356d95f3da2204f11556579b1b4fc566e71438f59b06efaaeb5e52ab202d0
MD5 8ff570369d4a8c3f5710589481cea2d9
SHA1 b0c49e1bfd1c6974405aaa91b74a328ee5033540
SHA512 82ab64eae4b09b8f8f8fae4b98825c415caf63aeb5fefaca1c991b6986a339be48f1e7ce3d8b7a06b4f065646ebe0099f8f900bae87634697c80c37fd0d9aaea
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphse2RUFikNUAi8wU8epku:A9iIxuERzA83h09RZxYhyWdiPU8bu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 af7b10078be2ef01a52ca00c7186682daec27fe0974dc794ab05e978872cff1b
MD5 84ae31e60862a52102c3616bedca005e
SHA1 73409232479c969cb22b1067495a19a40ed5dae6
SHA512 5c5f8bd93b678368238d725140b15c5aa40c7ebd56a0c9765aa645f53d44cf2bf8d80395d8be32463887c2f8c944c6ad237720b72dff219369b0ceeb36afeee4
SSDEEP 192:goCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphse2RUFikNuAi8wU8epku:Y9iIxuERzA83h09RZxYhyWTiPU8bu
MD5 SHA1 SHA512 SSDEEP

Submit Download

release.zip

Path C:\Users\Admin\Downloads\release.zip
Size 445KB
SHA256 c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
MD5 06a4fcd5eb3a39d7f50a0709de9900db
SHA1 50d089e915f69313a5187569cda4e6dec2d55ca7
SHA512 75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
SSDEEP 12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\release\Client-built.exe
Size 78KB
SHA256 96c6385fb6bdd295d6c113e11cf3de859390d97b9097df6f186026e6eb6f4c2a
MD5 253383fb64a0395de711dc2d1800af5a
SHA1 a705abc8be18c874d96ecb1d87759a8a85dac303
SHA512 425de313d780d1fddb69a8d8b469553300769d5f807d7205410ace0de875e15aef40caa21138d6fc776fba44d1c260f466058f29e613024583bf82eab06bfc59
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+1PIC:5Zv5PDwbjNrmAE+lIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3520-241-0x0000000000EF0000-0x0000000000EF8000-memory.dmp

Download

memory/3520-244-0x00000000059A0000-0x00000000059AA000-memory.dmp

Download

memory/3520-300-0x0000000008D20000-0x0000000008E42000-memory.dmp

Download

memory/3520-243-0x00000000058F0000-0x0000000005982000-memory.dmp

Download

memory/3520-242-0x0000000005DC0000-0x0000000006364000-memory.dmp

Download

memory/4772-305-0x0000024E4CCF0000-0x0000024E4CD08000-memory.dmp

Download

memory/4772-306-0x0000024E673D0000-0x0000024E67592000-memory.dmp

Download

memory/4772-307-0x0000024E67BD0000-0x0000024E680F8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads