discordrat | a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f

Analysis

max time kernel
214s
max time network
268s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
27-05-2024 19:59

Target

Client-built.exe
Size

78KB
MD5

6c7dfceb22fe0ef78835f29e53ae6b3e
SHA1

c8b290b0ec67a3cadfa6766cf1e630414c1c61c1
SHA256

a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f
SHA512

a506c076fe1b06c873aee2ebad22e953c3e0cf766736fa05f66f60031f7f7184c4d81e033f7787dfd1e007ec1feed88717a900fb76acb9fd42b8294807ef2964
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE1ODQ5NzkyODQ2MjIwNTExOQ.GRJ0l6.7SpFGKSu5G_J8dWAJje9hfCtSecIS6RuVXIE_E
server_id
1153564868197236846

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of AdjustPrivilegeToken 5 IoCs

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4936

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

memory/416-0-0x000002038BA70000-0x000002038BA88000-memory.dmp

Filesize
96KB

Download
memory/416-1-0x00007FFD03473000-0x00007FFD03475000-memory.dmp

Filesize
8KB

Download
memory/416-2-0x00000203A6260000-0x00000203A6422000-memory.dmp

Filesize
1.8MB

Download
memory/416-3-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download
memory/416-4-0x00000203A74E0000-0x00000203A7A08000-memory.dmp

Filesize
5.2MB

Download
memory/416-5-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download
memory/4888-6-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download
memory/4888-7-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download
memory/4888-8-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download
memory/4888-9-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download