Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 08:50
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
4cc3a192f38f0ba95fa9d68e97f6ef3c
-
SHA1
be1939d58b92d674a6de1687c66dae7d4dd2ecee
-
SHA256
aa0316816724b47a30eb700b8034f12e1387827bf6ad4305c81dbe31f2ba1f0f
-
SHA512
2b8cc93b66a8afd3941baa2ce76a25db53e5843d3751baad6cdc050d8a52c4d84cd23271da6d7781c589fff4352f06e39529e8a80c78e1acb36181be51c253c4
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0MTMxMTE3MDk1NTMxNzM1OQ.GtZ2dx.2B3nuUu0A_CuQdHvi3hc41LhN-OI3weFEtjBqU
-
server_id
1241107698636820601
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2020 2132 Client-built.exe 28 PID 2132 wrote to memory of 2020 2132 Client-built.exe 28 PID 2132 wrote to memory of 2020 2132 Client-built.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2132 -s 6002⤵PID:2020
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2148