Analysis
- max time kernel
92s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/06/2024, 10:06
General
- Target 8QER18Z.exe
- Size 78KB
- Sample240607-l44xjaff77
- SHA256 fa7cb5330959d52657751fe369325137d5c365dccc134250c416c5df4bc40af8
Malware Config
Extracted
-
discordrat
-
discord_token
MTI0MzQ4NjYwMDI2NTIwMzgxMw.GFMHDI.ux9Qi4OCEE_KLWWm4QZhKeMVsEu7ct9NCw5ZxY
-
server_id
1243486320794402826
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8QER18Z.exe"C:\Users\Admin\AppData\Local\Temp\8QER18Z.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$778QER18Z.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\8QER18Z.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3444-0-0x0000018973FB0000-0x0000018973FC8000-memory.dmp
memory/3444-1-0x00007FFC279D3000-0x00007FFC279D5000-memory.dmp
memory/3444-2-0x00000189765C0000-0x0000018976782000-memory.dmp
memory/3444-3-0x00007FFC279D0000-0x00007FFC28491000-memory.dmp
memory/3444-4-0x0000018976DC0000-0x00000189772E8000-memory.dmp
memory/3444-5-0x00007FFC279D3000-0x00007FFC279D5000-memory.dmp
memory/3444-6-0x00007FFC279D0000-0x00007FFC28491000-memory.dmp