Overview

overview

10

Static

static

10

test.exe

windows7-x64

10

test.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 11:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test.exe

  • Size

    78KB

  • MD5

    ae9c47b621a083a0b0681b7aa9530946

  • SHA1

    6cdd316cb5b2869927b42597b25cf7d495d5f9a4

  • SHA256

    aa3727520be4bc19a78da7f575a9dcc93c0b5c2743725300f942e7dee2eaa3b1

  • SHA512

    ae6330429bb9bc21709162296de375a79f5b8b89b3f4b58a5da12737b2fe0b44570e5eaab8fbb92ce190600fb1fc2a5f91fa425a719d8363a481d99f173bb109

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WYPIC:5Zv5PDwbjNrmAE+W8IC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0MDA4ODk5MTQwODE5MzYyOA.GRW5NI.uFPBjoMjH0IQ-FgxpiJSv246Xes3LsI1_5H1Y8

  • server_id

    1239434854953648229

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test.exe
    "C:\Users\Admin\AppData\Local\Temp\test.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4488
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1028,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
    1⤵
      PID:4636

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4488-1-0x000001ED0F520000-0x000001ED0F538000-memory.dmp

      Filesize

      96KB

      Download

    • memory/4488-0-0x00007FFF75663000-0x00007FFF75665000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4488-2-0x000001ED29D70000-0x000001ED29F32000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/4488-3-0x00007FFF75660000-0x00007FFF76121000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4488-4-0x000001ED2A470000-0x000001ED2A998000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/4488-5-0x00007FFF75660000-0x00007FFF76121000-memory.dmp

      Filesize

      10.8MB

      Download