Analysis
-
max time kernel
56s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
02-02-2025 21:02
Errors
Reason
Machine shutdown
General
-
Target
Matrix.exe
-
Size
78KB
-
MD5
f0a4ffc67ffbf866318bea08b4cdd538
-
SHA1
acc1205445cbf5a30e3c8218496c997390402259
-
SHA256
5c9d5f658db975741b3b76a10406698698a61f60ee92b52ef98385883eaddb2f
-
SHA512
46601af1adf87742d6f78859db4d68eed7baaf8ab4bb97c3644d0bde268f71b48ba6a66ef84e42d006872c2b7bafea48cbcf3eda0be59dc9be582d81a55e604d
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WPIC:5Zv5PDwbjNrmAE+SIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMyODY4Mjg2MjE3NzgxMjUwMg.GR7HEc.IEXnW7zdY83UmfxBEmYrn5HmOX_a4Z_5qwBR-c
-
server_id
1328680912891940864
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Matrix.exe"C:\Users\Admin\AppData\Local\Temp\Matrix.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
8KB
-
Filesize
10.8MB