Overview

overview

10

Static

static

10

ImageLogge...ed.exe

windows7-x64

10

ImageLogge...ed.exe

windows10-2004-x64

10

Resubmissions

26/01/2025, 06:17 UTC

250126-g134lswjbr 10

26/01/2025, 00:44 UTC

250126-a3vrpawkay 10

25/01/2025, 07:43 UTC

250125-jkl69ssqat 10

25/01/2025, 06:18 UTC

250125-g2zsks1nck 10

07/11/2024, 17:59 UTC

241107-wksehawmb1 10

06/11/2024, 11:31 UTC

241106-nm7m7szapg 10

05/11/2024, 22:04 UTC

241105-1y6aqsynhv 10

05/11/2024, 21:53 UTC

241105-1rm6ksyhqe 10

04/11/2024, 20:03 UTC

241104-ysp1fsvrfz 10

Analysis

  • max time kernel
    10s
  • max time network
    9s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2025, 06:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ImageLogger-cleaned.exe

  • Size

    78KB

  • MD5

    8460a2ac97b2c6d2658664c718f84533

  • SHA1

    110f9849759ff8b034fdf0eb36445c37187858af

  • SHA256

    6a88e4cd73a6a4b7768b1df63aa7ff54d911568d3cd62d88c4b447cec1cb1ff2

  • SHA512

    2286e4429ac1e829150db13b9896c9f6db7d6da4b2003742c831edfd2a21e29565e87bd97a9ef98802f20239d9c89139c5026a331506d4f24da4bd8f4a19affe

  • SSDEEP

    1536:2a/yGXNiPw3iU8Bz/oNrfxCXhRoKV6+V+kPIZ:lEzgNrmAE+4IZ

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI5NzUzOTkxNjAxNTg2NTkwNw.Gfdmm0.1DHqcqM266sEW3k8XieYxIORIkysBrFHb6r-3Q

  • server_id

    1297365710649036921

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Discordrat family
    discordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe
    "C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:432

Network

  • flag-us
    DNS
    gateway.discord.gg
    ImageLogger-cleaned.exe
    Remote address:
    8.8.8.8:53
    Request
    gateway.discord.gg
    IN A
    Response
    gateway.discord.gg
    IN A
    162.159.133.234
    gateway.discord.gg
    IN A
    162.159.135.234
    gateway.discord.gg
    IN A
    162.159.130.234
    gateway.discord.gg
    IN A
    162.159.136.234
    gateway.discord.gg
    IN A
    162.159.134.234
  • flag-us
    GET
    https://gateway.discord.gg/?v=9&encording=json
    ImageLogger-cleaned.exe
    Remote address:
    162.159.133.234:443
    Request
    GET /?v=9&encording=json HTTP/1.1
    Connection: Upgrade,Keep-Alive
    Upgrade: websocket
    Sec-WebSocket-Key: OvLVmrVTFP85+crZ17ZK4w==
    Sec-WebSocket-Version: 13
    Host: gateway.discord.gg
    Response
    HTTP/1.1 101 Switching Protocols
    Date: Sat, 25 Jan 2025 06:18:55 GMT
    Connection: upgrade
    sec-websocket-accept: 61kLTb88VO96ft9t0LpS581b3BI=
    upgrade: websocket
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8yGTERAXmD5wKnxTJZzFmC1ibe0IO3FAwyer%2F9YGL88CTddTnxj5Aa%2FvuLHJOD7QdwMXmkqomTCikTLlDfNpq0n5pKdWnWMwF4T0cVv2TxT4RsxZTWgx9YbLQUja%2FE50%2FBRNEw%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 907626112b65f650-LHR
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    234.133.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.133.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    234.133.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.133.159.162.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    216.87.200.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    216.87.200.23.in-addr.arpa
    IN PTR
    Response
    216.87.200.23.in-addr.arpa
    IN PTR
    a23-200-87-216deploystaticakamaitechnologiescom
  • flag-us
    DNS
    216.87.200.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    216.87.200.23.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    245.131.30.184.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    245.131.30.184.in-addr.arpa
    IN PTR
    Response
    245.131.30.184.in-addr.arpa
    IN PTR
    a184-30-131-245deploystaticakamaitechnologiescom
  • 162.159.133.234:443
    https://gateway.discord.gg/?v=9&encording=json
    tls, http
    ImageLogger-cleaned.exe
    1.8kB
     4.4kB
     14
    12

    HTTP Request

    GET https://gateway.discord.gg/?v=9&encording=json

    HTTP Response

    101
  • 8.8.8.8:53
    gateway.discord.gg
    dns
    ImageLogger-cleaned.exe
    64 B
     144 B
     1
    1

    DNS Request

    gateway.discord.gg

    DNS Response

    162.159.133.234
    162.159.135.234
    162.159.130.234
    162.159.136.234
    162.159.134.234

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    28.118.140.52.in-addr.arpa

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    234.133.159.162.in-addr.arpa
    dns
    148 B
     136 B
     2
    1

    DNS Request

    234.133.159.162.in-addr.arpa

    DNS Request

    234.133.159.162.in-addr.arpa

  • 8.8.8.8:53
    216.87.200.23.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    216.87.200.23.in-addr.arpa

    DNS Request

    216.87.200.23.in-addr.arpa

  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    245.131.30.184.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    245.131.30.184.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/432-0-0x00007FFAA2AA3000-0x00007FFAA2AA5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/432-1-0x000001E02FA00000-0x000001E02FA18000-memory.dmp

    Filesize

    96KB

    Download

  • memory/432-2-0x000001E04A0E0000-0x000001E04A2A2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/432-3-0x00007FFAA2AA0000-0x00007FFAA3561000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/432-4-0x000001E04A7E0000-0x000001E04AD08000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/432-5-0x00007FFAA2AA0000-0x00007FFAA3561000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.