discordrat | aa3727520be4bc19a78da7f575a9dcc93c0b5c2743725300f942e7dee2eaa3b1

Analysis

max time kernel
140s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

78KB
MD5

ae9c47b621a083a0b0681b7aa9530946
SHA1

6cdd316cb5b2869927b42597b25cf7d495d5f9a4
SHA256

aa3727520be4bc19a78da7f575a9dcc93c0b5c2743725300f942e7dee2eaa3b1
SHA512

ae6330429bb9bc21709162296de375a79f5b8b89b3f4b58a5da12737b2fe0b44570e5eaab8fbb92ce190600fb1fc2a5f91fa425a719d8363a481d99f173bb109
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WYPIC:5Zv5PDwbjNrmAE+W8IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0MDA4ODk5MTQwODE5MzYyOA.GRW5NI.uFPBjoMjH0IQ-FgxpiJSv246Xes3LsI1_5H1Y8
server_id
1239434854953648229

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	discord.com
11	discord.com
31	discord.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	test.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1028,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4488-1-0x000001ED0F520000-0x000001ED0F538000-memory.dmp

Filesize
96KB

Download
memory/4488-0-0x00007FFF75663000-0x00007FFF75665000-memory.dmp

Filesize
8KB

Download
memory/4488-2-0x000001ED29D70000-0x000001ED29F32000-memory.dmp

Filesize
1.8MB

Download
memory/4488-3-0x00007FFF75660000-0x00007FFF76121000-memory.dmp

Filesize
10.8MB

Download
memory/4488-4-0x000001ED2A470000-0x000001ED2A998000-memory.dmp

Filesize
5.2MB

Download
memory/4488-5-0x00007FFF75660000-0x00007FFF76121000-memory.dmp

Filesize
10.8MB

Download