Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2025, 16:39

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    2521a795346249cba9a1948e36b37ad5

  • SHA1

    5df2fc9e11e35ceb92a57835e30a25859ea37c15

  • SHA256

    21c42757554ed19066c0c6e2f8f06ce0e687bf898ad1dc1f75cd601fc957cb1a

  • SHA512

    c883e2cbad5701b25d3ddcbc1cffaa87113931c400e5379b7c683548eb3b89f3da999fdd3d61015f3161a6f75b3bcccc9054c55b980daeebf2a18534808a27f7

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIC:5Zv5PDwbjNrmAE+VIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMwODUzODYxNDg0MTM0NDAyMQ.GbOpEp.E5g2h9ghZFRq4jCP_0z_XExyb9BPRWYSiSJy8w

  • server_id

    1260941455514538138

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5060-0-0x00007FF972803000-0x00007FF972805000-memory.dmp

    Filesize

    8KB

  • memory/5060-1-0x000001B14A510000-0x000001B14A528000-memory.dmp

    Filesize

    96KB

  • memory/5060-2-0x000001B164BC0000-0x000001B164D82000-memory.dmp

    Filesize

    1.8MB

  • memory/5060-3-0x00007FF972800000-0x00007FF9732C1000-memory.dmp

    Filesize

    10.8MB

  • memory/5060-4-0x000001B1653C0000-0x000001B1658E8000-memory.dmp

    Filesize

    5.2MB

  • memory/5060-5-0x00007FF972800000-0x00007FF9732C1000-memory.dmp

    Filesize

    10.8MB