Analysis
- max time kernel
28s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
18/05/2024, 09:19
Errors
Reason
Machine shutdown
General
- Target SolaraBETA.exe
- Size 164KB
- Sample240518-lagj5sdb92
- SHA256 97998ce8ee1eb61773da4dd3480ac0573821233cef969b8b81c192600fa790e3
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIyODAzODA0Nzg2MjM2MjE4Mg.GeZ9Dk.99HQJjlOmDT6HLrABe4Y4tFyXqPaQdWTb6lSvI
-
server_id
1234555349349040179
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBETA.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBETA.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1640-0-0x0000021A39340000-0x0000021A3936C000-memory.dmp
memory/1640-1-0x00007FF8CEBF3000-0x00007FF8CEBF5000-memory.dmp
memory/1640-2-0x0000021A53AE0000-0x0000021A53CA2000-memory.dmp
memory/1640-3-0x00007FF8CEBF0000-0x00007FF8CF6B1000-memory.dmp
memory/1640-4-0x0000021A541E0000-0x0000021A54708000-memory.dmp
memory/1640-5-0x00007FF8CEBF0000-0x00007FF8CF6B1000-memory.dmp