Analysis
- max time kernel
134s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 21:27
General
- Target Builder_For_Zyrxo_showcases_All_tools.exe
- Size 78KB
- Sample240503-1arsfaab98
- SHA256 f40328db6d5644cca78656ea894e5c3d49de5c422701d500a44b2fa2ec27f6c5
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIzNDg1NjczODk4NjEzMTUwNw.GDwhNG.5j-vB_PJcUvnECKHd_P8s4cqebIgXE-n4QQZF0
-
server_id
1234856972927631390
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Builder_For_Zyrxo_showcases_All_tools.exe"C:\Users\Admin\AppData\Local\Temp\Builder_For_Zyrxo_showcases_All_tools.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1640-0-0x0000019603200000-0x0000019603218000-memory.dmp
memory/1640-1-0x00007FFC94993000-0x00007FFC94995000-memory.dmp
memory/1640-2-0x000001961D7A0000-0x000001961D962000-memory.dmp
memory/1640-3-0x00007FFC94990000-0x00007FFC95451000-memory.dmp
memory/1640-4-0x000001961E090000-0x000001961E5B8000-memory.dmp
memory/1640-5-0x00007FFC94990000-0x00007FFC95451000-memory.dmp