Analysis
- max time kernel
143s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
18/05/2024, 08:55
General
- Target aa0316816724b47a30eb700b8034f12e1387827bf6ad4305c81dbe31f2ba1f0f.exe
- Size 78KB
- Sample240518-kvmq8acf34
- SHA256 aa0316816724b47a30eb700b8034f12e1387827bf6ad4305c81dbe31f2ba1f0f
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI0MTMxMTE3MDk1NTMxNzM1OQ.GtZ2dx.2B3nuUu0A_CuQdHvi3hc41LhN-OI3weFEtjBqU
-
server_id
1241107698636820601
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa0316816724b47a30eb700b8034f12e1387827bf6ad4305c81dbe31f2ba1f0f.exe"C:\Users\Admin\AppData\Local\Temp\aa0316816724b47a30eb700b8034f12e1387827bf6ad4305c81dbe31f2ba1f0f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3508-0-0x00007FFEAC103000-0x00007FFEAC105000-memory.dmp
memory/3508-1-0x000001EC6A920000-0x000001EC6A938000-memory.dmp
memory/3508-2-0x000001EC6CF30000-0x000001EC6D0F2000-memory.dmp
memory/3508-3-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp
memory/3508-4-0x000001EC6D870000-0x000001EC6DD98000-memory.dmp
memory/3508-5-0x000001EC6CD60000-0x000001EC6CE62000-memory.dmp
memory/3508-7-0x00007FFEAC103000-0x00007FFEAC105000-memory.dmp
memory/3508-8-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp