Analysis
- max time kernel
12s - max time network
14s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/03/2024, 19:18
General
- Target Client-built.exe
- Size 78KB
- Sample240308-x1bmcsec84
- SHA256 cccf75bb8d71a45d611a20d4b9df9a2be374e6dba127d7253b9bd26547f26940
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIxNTczNTAxNTkzODMyNjU1OQ.G9yV-B._jUdHx9XSQSo5nyttxH-78hmGvNbNE21hal5Tw
-
server_id
1215731392072122550
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2496-0-0x0000020991FB0000-0x0000020991FC8000-memory.dmp
memory/2496-1-0x00000209AC630000-0x00000209AC7F2000-memory.dmp
memory/2496-2-0x00007FFD2C0A0000-0x00007FFD2CB61000-memory.dmp
memory/2496-3-0x0000020993C00000-0x0000020993C10000-memory.dmp
memory/2496-4-0x00000209ACE30000-0x00000209AD358000-memory.dmp