Analysis
-
max time kernel
210s -
max time network
300s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
11-05-2024 09:40
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
61131f2f21913b8bb7541cee380dbe2e
-
SHA1
f5deb3506f57ffffcf6f9a89138bf43dd357354f
-
SHA256
574ecf23ff525eb558619e23ceedd487d51bfc740e7309d2d33f640c2bdc3c93
-
SHA512
bce15457dc1e71ac04ae93b03ab1623bdcf9af66df64addc35d227ea181dbc99a0a71e160256abcb6426f4950d0a073ec80a37143389f443d9eaf338551bfaef
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+CPIC:5Zv5PDwbjNrmAE+uIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIzODc1NzE3NzMyNjU3MTYyMg.GuA-3-.g9QiCW1B45EpLzzB6J_2LKI2RFzAtkJhJQ1liQ
-
server_id
1238756667693338624
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
680KB
-
Filesize
10.8MB
-
Filesize
10.8MB