Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
-
submitted
10/01/2025, 01:38
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
b86d8efe9b7c845319b5c81c576cef1c
-
SHA1
53c711029eeac602223974fa462404ddf891891b
-
SHA256
b4fac89f795d7ef39a31e320b9b3c414ecbff3799ec2fdf2202ff1947e6dcd41
-
SHA512
a7e73d38ed9d81d2c4e35bded858355a80aeef1d1c1a8fbce7e91d8cf82ef9075144d7444de4a7e259e9764a7d30610f4ffa4daa959341c8bc510f8a0494265b
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMxNzk1MTI1OTgxODMzMjI1MQ.GKAyxn.C2N604MXRMjJY6a_7Fv_SRa3Og7h1pvsrL3mQU
-
server_id
1317948076505169970
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB