Analysis
-
max time kernel
94s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-02-2025 11:19
General
-
Target
d5034f65d36b31997ad2e15cd0e10c72ded654c099ef307984c4da937767e4a9N.exe
-
Size
391KB
-
MD5
ed019318b08c6ec18086e3d8cc8ed4a0
-
SHA1
c5b76f566ed8808d74a12766addbbb010fbe3aca
-
SHA256
d5034f65d36b31997ad2e15cd0e10c72ded654c099ef307984c4da937767e4a9
-
SHA512
dc05444db94d51bc6a9cd4479e6ffe24fcd5dc6bd551219e67d05641b47da1be0691a3ff5a557f1cd5bc9d1688b3b50fb5fcef1d23ae8def28e61c66a33206ab
-
SSDEEP
6144:7E+yclwQKjdn+WPtYVJIoBfYo/eyd8/tbrIQ7Oi9Ku:7BdlwHRn+WlYV+RVz/Nr17J
Malware Config
Extracted
discordrat
-
discord_token
MTMxNzUwNjY0NjkzMDYyMDQ5Ng.GNBK2Y.upogfQP8BcmxvUWnTPh9TiKyGPCxMpHGHpJtR0
-
server_id
1317507198582128671
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5034f65d36b31997ad2e15cd0e10c72ded654c099ef307984c4da937767e4a9N.exe"C:\Users\Admin\AppData\Local\Temp\d5034f65d36b31997ad2e15cd0e10c72ded654c099ef307984c4da937767e4a9N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rar.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5928b34327061b09e7e40759d04363eeb
SHA1a1e5715f0e0d054d654dcc6746b37c9a60f9ccfe
SHA256ea72c77769e394a017c08af3640c090d4216495d730f2612e8729d933589460c
SHA51262b8bd581583f872f4df5b2ffd999a31b6d98c6aa16ae522d02e2124995d5d4a4253e459b31af55abaaffd4e0d6bf373b5cc2b4b5269053994629f5ef82c2250
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB