discordrat | 43d86b0fc95ce07b8f58b9563331ae8cc2cd2dd262630849f50d7627dddd2033

Resubmissions

24/02/2024, 06:58

240224-hrqmladd8w 10

19/02/2024, 18:06

240219-wpq28sag74 10

Analysis

max time kernel
275s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshare.exe
Size

78KB
MD5

70b3eeef461d8d7ecab87148bdc5da0b
SHA1

3f009f215e2fb8912b9a4e18e57f987187dae35d
SHA256

43d86b0fc95ce07b8f58b9563331ae8cc2cd2dd262630849f50d7627dddd2033
SHA512

67d3dcf3b96dca3d13a1e632939a68572079ec24fef8e97935d6ac88124d4f24c338e520a8e3182ee95f7823281c4d172e536170647c0ecb6b4520ad1fa563a4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+M6PIC:5Zv5PDwbjNrmAE+MmIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTA0MDgyMTIzNDg2ODQzNzAyNw.GtcA8A.6TpBs-kYgoKXVc6Z9vKobut--ke0IH5N9tFS0g
server_id
1207140966327263283

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	Screenshare.exe
Token: SeDebugPrivilege	4596	Screenshare.exe
Token: SeDebugPrivilege	1628	Screenshare.exe
Token: SeDebugPrivilege	2000	Screenshare.exe
Token: SeDebugPrivilege	856	Screenshare.exe
Token: SeDebugPrivilege	4420	Screenshare.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2300	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Screenshare.exe
"C:\Users\Admin\AppData\Local\Temp\Screenshare.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2300

C:\Users\Admin\AppData\Local\Temp\Screenshare.exe
"C:\Users\Admin\AppData\Local\Temp\Screenshare.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Users\Admin\AppData\Local\Temp\Screenshare.exe
"C:\Users\Admin\AppData\Local\Temp\Screenshare.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Users\Admin\AppData\Local\Temp\Screenshare.exe
"C:\Users\Admin\AppData\Local\Temp\Screenshare.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Users\Admin\AppData\Local\Temp\Screenshare.exe
"C:\Users\Admin\AppData\Local\Temp\Screenshare.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Users\Admin\AppData\Local\Temp\Screenshare.exe
"C:\Users\Admin\AppData\Local\Temp\Screenshare.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-15-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/856-20-0x000001CE6CD60000-0x000001CE6CD70000-memory.dmp

Filesize
64KB

Download
memory/856-19-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/1628-10-0x000001ABB8CA0000-0x000001ABB8CB0000-memory.dmp

Filesize
64KB

Download
memory/1628-9-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/1628-13-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/2000-14-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/2000-17-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/2000-18-0x00000157ED870000-0x00000157ED880000-memory.dmp

Filesize
64KB

Download
memory/3952-1-0x0000021F483A0000-0x0000021F48562000-memory.dmp

Filesize
1.8MB

Download
memory/3952-0-0x0000021F2DDD0000-0x0000021F2DDE8000-memory.dmp

Filesize
96KB

Download
memory/3952-3-0x0000021F482C0000-0x0000021F482D0000-memory.dmp

Filesize
64KB

Download
memory/3952-4-0x0000021F48CE0000-0x0000021F49208000-memory.dmp

Filesize
5.2MB

Download
memory/3952-6-0x0000021F482C0000-0x0000021F482D0000-memory.dmp

Filesize
64KB

Download
memory/3952-5-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/3952-2-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/4420-16-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/4596-8-0x00000208FBFB0000-0x00000208FBFC0000-memory.dmp

Filesize
64KB

Download
memory/4596-12-0x00000208FBFB0000-0x00000208FBFC0000-memory.dmp

Filesize
64KB

Download
memory/4596-11-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download
memory/4596-7-0x00007FFD8C9A0000-0x00007FFD8D461000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads