Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/04/2024, 11:44
General
- Target reducer.exe
- Size 29KB
- Sample240404-nv8v8sef94
- SHA256 d01b49ea8c4f9215e0838147fb4eb5909c6298e9f1314e7401faf0d6cbc5d9e0
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTEyOTg3Mzk2MjY0MjQ2MDc3Mw.GVoB7q.zgQTyRC6__mUfWAQ71TKowd69RCw5b2gtOewvc
-
server_id
979482293682978877
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\reducer.exe"C:\Users\Admin\AppData\Local\Temp\reducer.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DriverFolder\Reducer.exe"C:\Users\Admin\AppData\Local\Temp\DriverFolder\Reducer.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Reducer.exe
memory/884-27-0x00000252D8560000-0x00000252D8578000-memory.dmp
memory/884-30-0x00000252F2BF0000-0x00000252F2DB2000-memory.dmp
memory/884-32-0x00007FFA7C4C0000-0x00007FFA7CF81000-memory.dmp
memory/884-33-0x00000252F2B50000-0x00000252F2B60000-memory.dmp
memory/884-34-0x00000252F3CE0000-0x00000252F4208000-memory.dmp
memory/884-35-0x00007FFA7C4C0000-0x00007FFA7CF81000-memory.dmp
memory/884-36-0x00000252F2B50000-0x00000252F2B60000-memory.dmp