Resubmissions
17-01-2025 14:19
250117-rnbhyasjfq 10Analysis
-
max time kernel
163s -
max time network
171s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
17-01-2025 14:19
General
-
Target
Pharaoh executor.exe
-
Size
78KB
-
MD5
67704f500aeba4f18486e5a45c323270
-
SHA1
eced935899eec5690c5c629609c7f14e6f2e7b65
-
SHA256
98e6b9e414f6656129d0354500298099b579c6f3be734c1cb4f6ef2c5c1697e9
-
SHA512
6b1c3fd771899c86ec1f726bb39564f97251caa01ab57177059830356d96cbdc75cd8d98660740a4778a13d11493172468b0632401aa77a7482205acc89e0bfc
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ePIC:5Zv5PDwbjNrmAE+aIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMyOTgwOTU2Njg4MzY0MzQ3NA.GVHs26._y_WggY_G50UL40yHSqpk4DJou__dKr0rqoBgM
-
server_id
1325490052163309628
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pharaoh executor.exe"C:\Users\Admin\AppData\Local\Temp\Pharaoh executor.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
2.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
680KB
-
Filesize
10.8MB