Analysis
-
max time kernel
93s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 17:47
General
-
Target
a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe
-
Size
545KB
-
MD5
4048ba7b33561ad82e221babd0dde0c1
-
SHA1
91a451f9082a99befae9e01410331e0607a2759f
-
SHA256
a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8
-
SHA512
029ec093da60658f5fbfe3026f3265e73c6d38cc2b7509d89a7f1d138aa042e6ecf308ad36fe84f8c75563da08537db58ab0e19a6306960309772de5c287e7c7
-
SSDEEP
12288:syveQB/fTHIGaPkKEYzURNAwbAg831KIiVkmeT5D3SaE:suDXTIGaPhEYzUzA0qFKJMD3SaE
Malware Config
Extracted
discordrat
-
discord_token
MTMzMDYzMDE4NTEzMjg4NDAzOQ.GKdnEl.mme8TYp-zKiBazpkuwncKPoIlsQtVXLw9Vu4WY
-
server_id
1330630815956340776
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe"C:\Users\Admin\AppData\Local\Temp\a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\BmwSpooferV2.4.1.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\BmwSpooferV2.4.1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5a48d8bac27884e15820edd5788553011
SHA18a47506f977deb6964a29e1cf26029913b13a058
SHA256d840fb32311552aef24fa0b404f570cb34ccbeb274a40c710d1cf1dc63b7a0a2
SHA512fe009ceb484b5af352d686a6c4c3c3172156fce629e96666d7fef92d3b2864d4d6d798441c8ccc99e4b0fc2d944706b62edc2a00187e4aabe28895b276de2291
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
10.8MB