Analysis
-
max time kernel
172s -
max time network
219s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13-03-2024 09:52
General
-
Target
Main/RUN_ME.bat
-
Size
20B
-
MD5
e33b065e04e13f92aa194ddb6f7bb9d8
-
SHA1
0c651171deee149f84e8feee2eeef678ee19b581
-
SHA256
a2ff24b8dbd5f24390c24092f83b2deaadae82bc588e50ca1c618b22ee3f8ec2
-
SHA512
155d0a18ffac00414250061c1010508a9c7b512dd0b0910a154655dc9e0e0dc5950762776c3c8195ad28797a661d49e25c5e2496e217457f8824bb58a7805b3a
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIxNzA3NzI2Njc5OTEzMjc5NA.G6xQaE.4zXFoh6BPZlAIhLi46DSS2BaJjbxuU5eXQ1tP8
-
server_id
1190067527355744316
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Main\RUN_ME.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Main\build.exebuild.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
64KB