Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
24/03/2024, 19:41
General
- Target Client-built.exe
- Size 78KB
- Sample240324-yehdfsff46
- SHA256 a938ff9ba13e88cd2989b4e7c4ec27805242a5da86d23d6ff7fbe0a1a868ba4f
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIyMTU0MzQwNjU4MTMyMTc2OA.GnG4Nm.0S3-zLC_CuQZnYYEbaguj4NVMBsyRSCgReVpu8
-
server_id
1221543160388259971
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1484-0-0x0000020E3A480000-0x0000020E3A498000-memory.dmp
memory/1484-1-0x0000020E54B30000-0x0000020E54CF2000-memory.dmp
memory/1484-3-0x0000020E3A850000-0x0000020E3A860000-memory.dmp
memory/1484-2-0x00007FFEFB230000-0x00007FFEFBCF1000-memory.dmp
memory/1484-4-0x0000020E55330000-0x0000020E55858000-memory.dmp
memory/1484-5-0x00007FFEFB230000-0x00007FFEFBCF1000-memory.dmp
memory/1484-6-0x0000020E3A850000-0x0000020E3A860000-memory.dmp