Analysis Overview
SHA256
ba9a3e3afa4e938dc92e32290e731e0e053c978029d1e3fec40dcfd73a8ce5a1
Threat Level: Shows suspicious behavior
The file Anti_Discord_RAT_BETA.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Legitimate hosting services abused for malware hosting/C2
Sets desktop wallpaper using registry
Unsigned PE
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-19 05:49
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-19 05:49
Reported
2024-05-19 05:52
Platform
win11-20240426-en
Max time kernel
89s
Max time network
134s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpE35B.tmp.png" | C:\Users\Admin\AppData\Local\Temp\Anti_Discord_RAT_BETA.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Anti_Discord_RAT_BETA.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Anti_Discord_RAT_BETA.exe
"C:\Users\Admin\AppData\Local\Temp\Anti_Discord_RAT_BETA.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 162.159.134.234:443 | gateway.discord.gg | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 162.159.134.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
Files
memory/4760-0-0x00007FFA0B4D3000-0x00007FFA0B4D5000-memory.dmp
memory/4760-1-0x00000201D2AF0000-0x00000201D2BC0000-memory.dmp
memory/4760-2-0x00000201ED1C0000-0x00000201ED382000-memory.dmp
memory/4760-3-0x00007FFA0B4D0000-0x00007FFA0BF92000-memory.dmp
memory/4760-4-0x00000201EE790000-0x00000201EECB8000-memory.dmp
memory/4760-5-0x00007FFA0B4D3000-0x00007FFA0B4D5000-memory.dmp
memory/4760-6-0x00007FFA0B4D0000-0x00007FFA0BF92000-memory.dmp