Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 17:06
General
- Target Fluxus V7.exe
- Size 78KB
- Sample240604-vmsbvade7t
- SHA256 540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI0NjMwMTQ1MjQwNjc1MTI0Mg.GoEe4D.Ukxxcg2g6oiBh3IEoYa6C5FTUz1iU45J3sp1bU
-
server_id
1246300545325727776
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fluxus V7.exe"C:\Users\Admin\AppData\Local\Temp\Fluxus V7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1568-0-0x00007FFA94B33000-0x00007FFA94B35000-memory.dmp
memory/1568-1-0x000002D392110000-0x000002D392128000-memory.dmp
memory/1568-2-0x000002D3AC810000-0x000002D3AC9D2000-memory.dmp
memory/1568-3-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp
memory/1568-4-0x000002D3AD010000-0x000002D3AD538000-memory.dmp
memory/1568-5-0x00007FFA94B33000-0x00007FFA94B35000-memory.dmp
memory/1568-6-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp