Analysis

  • max time kernel
    453s
  • max time network
    580s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-04-2024 15:42

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    deaf5dca76c8d07ba1dde0c427e72255

  • SHA1

    970a7fe7fbad3038a535f5e92cb45c24875d9822

  • SHA256

    7ecf30ca60d35b0e45c14bf6f2108f7227b06efc456aa91bc1fe0525524f326e

  • SHA512

    c733d3f24f7784bf8468f78713e9e35d6afe2150af9263a3a86c77fe94b41e33c0e24e72fcf0cbdd2aca4e9f388978815580e8e32edfcf2c130e3527cae2b73b

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YPIC:5Zv5PDwbjNrmAE+8IC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTExOTY4MDYxNDIxNjUxNTY5NQ.G4EXsN.rare5BIxmEl7wss7NznVobbl9DJL5xulluzALs

  • server_id

    1229094624333926517

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2220-0-0x0000018E06E60000-0x0000018E06E78000-memory.dmp

    Filesize

    96KB

  • memory/2220-1-0x0000018E215B0000-0x0000018E21772000-memory.dmp

    Filesize

    1.8MB

  • memory/2220-2-0x00007FFE63670000-0x00007FFE64132000-memory.dmp

    Filesize

    10.8MB

  • memory/2220-3-0x0000018E072D0000-0x0000018E072E0000-memory.dmp

    Filesize

    64KB

  • memory/2220-4-0x0000018E22830000-0x0000018E22D58000-memory.dmp

    Filesize

    5.2MB

  • memory/2220-5-0x00007FFE63670000-0x00007FFE64132000-memory.dmp

    Filesize

    10.8MB

  • memory/2220-6-0x0000018E072D0000-0x0000018E072E0000-memory.dmp

    Filesize

    64KB