Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 14:25
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
440b996c5d07343f49171b3ab4ff1369
-
SHA1
3a5c605d16a62466a5cde0b42afb00ff6f50c208
-
SHA256
a357809e2125e8e840c0dc8b091b564b668b38f016d05629a5fb070d20e401f9
-
SHA512
19cf3b3afe18b688acd9e259163e60263936b484b0fee3789e3170ad0c1a349569d16c4edbf40ad5f63a54b8713242f632c38854dade2fad9c61910bf2f418c9
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIyNjg0MzM1NDk2OTY2OTY5Mg.Gy9KZQ.NY-KwcbQ8yEx9fTi-etQyNnQ0BqzTHoeJ9s1Eo
-
server_id
1225922728725581906
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2372 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2372 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe 2372 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1508 2204 Client-built.exe 28 PID 2204 wrote to memory of 1508 2204 Client-built.exe 28 PID 2204 wrote to memory of 1508 2204 Client-built.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2204 -s 6002⤵PID:1508
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2372