Resubmissions
22-02-2025 09:45
250222-lq722atpbq 10Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
22-02-2025 09:42
General
-
Target
Slip.cc 2.exe
-
Size
78KB
-
MD5
c8253bce24fc725a44dd1d7d4bcb37d1
-
SHA1
63e19c75281583c4aaf6bc36a6ca2bca30ba558f
-
SHA256
247d661d487938ff1419584c1ffa411de89ff5dcb40053d7be51e321d7bddfad
-
SHA512
6cfc09b61da4cb88bce3bc7b2c8b5afd59901e660ea51348865df81af3f0d5c3271e2a37cef0f324d3186cc07b1f78e240d3e0b8c8c3ae677127710cce77fc63
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC
Malware Config
Extracted
discordrat
-
discord_token
MTM0Mjc0MDk3MzQ4MjAxNjg0MA.GPkOp9.jLGDelzjPDXfKBCbh7KnYItZqub2qGH7OR9IQo
-
server_id
1342765305788629043
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Slip.cc 2.exe"C:\Users\Admin\AppData\Local\Temp\Slip.cc 2.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Slip.cc 2.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Slip.cc 2.exe'" /sc onlogon /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB