Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 19:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    c9f6d0a2a978429bff3496d993339f06

  • SHA1

    58cf521791e969f1edecaf0e1e15fe8467e8205d

  • SHA256

    b1017a29cab062a104a5b946fbc23057738e7227289e1cf115cf82d9257e17b1

  • SHA512

    71bbf11f06faaf4fb355e33fd88923f02e7f25a7da667f5d4b620e697c9f072e8a34e3c0c745858d6b17dcb85e01a6c5962e98cbdd7097d0a442141470c02304

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0NDM2Nzk4MjY3OTk0OTMyMg.Gv6eq-.Uq2lfr6CoxdEIxVy6jaTNSsvh2dmcKyuVrJL9k

  • server_id

    1242477718638170204

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3688-0-0x000001F079D50000-0x000001F079D68000-memory.dmp
    Filesize

    96KB

    Download
  • memory/3688-1-0x00007FF8AF063000-0x00007FF8AF065000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3688-2-0x000001F07C6B0000-0x000001F07C872000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3688-3-0x00007FF8AF060000-0x00007FF8AFB21000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3688-4-0x000001F07CDB0000-0x000001F07D2D8000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/3688-5-0x00007FF8AF060000-0x00007FF8AFB21000-memory.dmp
    Filesize

    10.8MB

    Download