Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/01/2025, 19:06

250124-xr62xatkbt 10

24/01/2025, 18:25

250124-w2yb3s1pdt 10

Analysis

  • max time kernel
    112s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 18:25

General

  • Target

    TEST.exe

  • Size

    78KB

  • MD5

    d342164488b5574da639e404c0756831

  • SHA1

    1896ec0095610935993935b1fa14678d729e3d12

  • SHA256

    0a5829c5c2d1ffb068abcffc0a6f808438a52cbb7e974445d08770428b96c7b7

  • SHA512

    0b9b76906bf6ec4e2868d3412df69ee77bef132ff2396c2cf802c44e909c53635bfccdfd23fae3b55560f4e83edacec529311f94901e6c23654e4f8bb8e62590

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMzMjQwOTA2MzQ5NzAwNzIwNA.G_n8fU.DfbgmS7-yP4cbSNse2dBgOV4sXge7EKO5X8MBo

  • server_id

    1332408693144420362

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Downloads MZ/PE file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TEST.exe
    "C:\Users\Admin\AppData\Local\Temp\TEST.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of AdjustPrivilegeToken
    PID:1684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1684-0-0x0000019E418B0000-0x0000019E418C8000-memory.dmp

    Filesize

    96KB

  • memory/1684-1-0x00007FFA5E943000-0x00007FFA5E945000-memory.dmp

    Filesize

    8KB

  • memory/1684-2-0x0000019E5BFC0000-0x0000019E5C182000-memory.dmp

    Filesize

    1.8MB

  • memory/1684-3-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

    Filesize

    10.8MB

  • memory/1684-4-0x0000019E5C7C0000-0x0000019E5CCE8000-memory.dmp

    Filesize

    5.2MB

  • memory/1684-5-0x00007FFA5E943000-0x00007FFA5E945000-memory.dmp

    Filesize

    8KB

  • memory/1684-6-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

    Filesize

    10.8MB

  • memory/1684-7-0x0000019E5BF40000-0x0000019E5BFB6000-memory.dmp

    Filesize

    472KB

  • memory/1684-8-0x0000019E43510000-0x0000019E43522000-memory.dmp

    Filesize

    72KB

  • memory/1684-9-0x0000019E43670000-0x0000019E4368E000-memory.dmp

    Filesize

    120KB

  • memory/1684-10-0x0000019E5C430000-0x0000019E5C6FA000-memory.dmp

    Filesize

    2.8MB

  • memory/1684-12-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

    Filesize

    10.8MB