Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Resubmissions

08-04-2024 09:27

240408-le461adh44 10

08-04-2024 09:27

240408-lezxaahc2w 10

08-04-2024 09:27

240408-leq95shb9z 10

08-04-2024 09:22

240408-lccnzadg79 10

08-04-2024 09:04

240408-k1wlbade64 10

08-04-2024 09:03

240408-k1g3xsde49 10

08-04-2024 08:59

240408-kx8fpsdd79 10

Analysis

  • max time kernel
    1795s
  • max time network
    1803s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 09:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    ad8199a07ecbffb2b61f1866d7a32fab

  • SHA1

    9fef07bdbc58f57a0dc118fcabf255abbb74cec4

  • SHA256

    295cd12d448a0960ae0b2502505bfb0c23b11b651a28ff92f5c04c18712c787f

  • SHA512

    517440347557ad4e3cae8f53df037ba37afa56bf59ec413d08ec70794daf1dd629e6eba302bbe1461368c00981eeeb899c209ad94aba8785a9173484dfbdb39d

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIC:5Zv5PDwbjNrmAE+VIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIyNjc5NDI2OTc0Mjk4OTM1Mg.GGcfSn.O22YiEnqD05TMhl029CMEeHyqw41ZN4YIb_np8

  • server_id

    908750895850872873

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4508
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3064 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1544
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5020 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:456
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:2988
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3208

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3208-23-0x000001F287350000-0x000001F287360000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3208-39-0x000001F28F6C0000-0x000001F28F6C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3208-41-0x000001F28F6F0000-0x000001F28F6F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3208-42-0x000001F28F6F0000-0x000001F28F6F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3208-43-0x000001F28F800000-0x000001F28F801000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4508-0-0x000001146F750000-0x000001146F768000-memory.dmp

          Filesize

          96KB

          Download

        • memory/4508-1-0x0000011471CA0000-0x0000011471E62000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/4508-2-0x00007FFEAAE00000-0x00007FFEAB8C1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4508-3-0x0000011471BC0000-0x0000011471BD0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4508-4-0x0000011472E90000-0x00000114733B8000-memory.dmp

          Filesize

          5.2MB

          Download

        • memory/4508-5-0x00007FFEAAE00000-0x00007FFEAB8C1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4508-6-0x0000011471BC0000-0x0000011471BD0000-memory.dmp

          Filesize

          64KB

          Download