Analysis
- max time kernel
92s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
24/03/2024, 19:38
General
- Target Client-built.exe
- Size 78KB
- Sample240324-ycevjsad9v
- SHA256 a938ff9ba13e88cd2989b4e7c4ec27805242a5da86d23d6ff7fbe0a1a868ba4f
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIyMTU0MzQwNjU4MTMyMTc2OA.GnG4Nm.0S3-zLC_CuQZnYYEbaguj4NVMBsyRSCgReVpu8
-
server_id
1221543160388259971
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1876-0-0x000001D16F880000-0x000001D16F898000-memory.dmp
memory/1876-1-0x000001D171FA0000-0x000001D172162000-memory.dmp
memory/1876-2-0x00007FFEE7340000-0x00007FFEE7E01000-memory.dmp
memory/1876-3-0x000001D171EE0000-0x000001D171EF0000-memory.dmp
memory/1876-4-0x000001D1727E0000-0x000001D172D08000-memory.dmp
memory/1876-5-0x00007FFEE7340000-0x00007FFEE7E01000-memory.dmp
memory/1876-6-0x000001D171EE0000-0x000001D171EF0000-memory.dmp