Analysis
-
max time kernel
117s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 05:00
General
-
Target
fortnitegpj.exe
-
Size
872KB
-
MD5
4498571a9abae3109110f8269dcd3161
-
SHA1
8ba4b502d42b784cd9dc61c0ba4b4eec7af55db1
-
SHA256
a7e621222694b1384179574cd023ca68cbd5da5cb36a3de563c04f93c4286dbb
-
SHA512
414b90fa966969e7ebaf7cfb262afd42894bc964fe9ba7587f559055fb5922ca174c7777d5b5de1a3843dd71304ebb48d94a3ddfee2aadcaecd96c09ee9fb57c
-
SSDEEP
24576:X5ZWs+OZVEWry8AFBn+yHDB17T4ZrCqKkFPJ1x1CwrNa6h8kQU1s:JZB1G8Yt+yjT/SCoFzxr46ho9
Malware Config
Extracted
discordrat
-
discord_token
MTE3MDQzNjc1NDU1NDI0NTE4MA.GR3Xh1.pvHYX3HiB6vpnvhTb33A2CfQZZTlCD26XRDRqs
-
server_id
1298154591732629564
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fortnitegpj.exe"C:\Users\Admin\AppData\Local\Temp\fortnitegpj.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C whoami3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5b27fd4f421612aedfe5c04bc98501213
SHA1355140fc9877f094127b432e39581d13ce17437e
SHA2568600dfff2cf54d37ae8d5859eb4b6410f9b97f0b0945a068ca3e5be9a5289398
SHA5128129ce007dac1f1494702a1315f8bedf6c1872150accfe70f3f25f5031d7cd373a8edbf1a59f8c8ba44ad61863c73c2177e5f77786fb43cb48bf6eb43916e94e
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB