Analysis
- max time kernel
91s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
03/04/2024, 01:04
General
- Target crack hx.exe
- Size 78KB
- Sample240403-be7l1sbb68
- SHA256 5b8271ad734987abb76bc62fbcc32f271333b56f3d18aad1daf0c15994ca799c
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIwMzQ2NzM1NjQ0MjA3NTIwNg.GRBQTc.Z-71_qp27BcmJ3PM4vJ2xw62CJJiX5WZkqr4Ic
-
server_id
1203387593627144203
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\crack hx.exe"C:\Users\Admin\AppData\Local\Temp\crack hx.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3556-0-0x0000022039070000-0x0000022039088000-memory.dmp
memory/3556-1-0x0000022053940000-0x0000022053B02000-memory.dmp
memory/3556-2-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp
memory/3556-3-0x0000022053CF0000-0x0000022053D00000-memory.dmp
memory/3556-4-0x0000022054230000-0x0000022054758000-memory.dmp
memory/3556-5-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp
memory/3556-6-0x0000022053CF0000-0x0000022053D00000-memory.dmp