discordrat | 048568f21de0495068ca83db248cc235578abd489e416c97001a8af6cd54af98

Analysis

max time kernel
96s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09-06-2024 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

celex cracked.exe
Size

78KB
MD5

838552dd5effcd196247bf7476c11787
SHA1

05ed3b610c5a6537aec6652366175eef41ebd281
SHA256

048568f21de0495068ca83db248cc235578abd489e416c97001a8af6cd54af98
SHA512

1c91f1292b2722330141b4671cd6587368d2d86bfc3c38e906d459822bd7d4a2fb49c25d9c13ecfbf45368f3acfd49bec5a6b305c23e1f3ee09a4ef87e83522b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0OTM2MzAwMDAzNzYwNTQ2OA.G2Z8iB.JlHA8lZ2dU5w37dmNBpG7AYm7TcaKA0xvUPkeM
server_id
1249359208781058119

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

19 discord.com
1 discord.com
3 discord.com
6 discord.com
15 discord.com
16 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

celex cracked.exe

description pid process

Token: SeDebugPrivilege 1972 celex cracked.exe

flow	ioc
19	discord.com
1	discord.com
3	discord.com
6	discord.com
15	discord.com
16	discord.com

description	pid	process
Token: SeDebugPrivilege	1972	celex cracked.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

celex cracked.exe

description	pid	process	target process
PID 1972 wrote to memory of 1516	1972	celex cracked.exe	shutdown.exe
PID 1972 wrote to memory of 1516	1972	celex cracked.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\celex cracked.exe
"C:\Users\Admin\AppData\Local\Temp\celex cracked.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\System32\shutdown.exe
"C:\Windows\System32\shutdown.exe" /r /t 0
2⤵
PID:1516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2872

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a0c855 /state1:0x41c64e6d
1⤵
PID:2856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-1-0x00000202573D0000-0x00000202573E8000-memory.dmp

Filesize
96KB

Download
memory/1972-0-0x00007FF836C73000-0x00007FF836C75000-memory.dmp

Filesize
8KB

Download
memory/1972-2-0x0000020271A60000-0x0000020271C22000-memory.dmp

Filesize
1.8MB

Download
memory/1972-3-0x00007FF836C70000-0x00007FF837732000-memory.dmp

Filesize
10.8MB

Download
memory/1972-4-0x0000020272CE0000-0x0000020273208000-memory.dmp

Filesize
5.2MB

Download
memory/1972-5-0x00007FF836C73000-0x00007FF836C75000-memory.dmp

Filesize
8KB

Download
memory/1972-6-0x00007FF836C70000-0x00007FF837732000-memory.dmp

Filesize
10.8MB

Download
memory/1972-7-0x00007FF836C70000-0x00007FF837732000-memory.dmp

Filesize
10.8MB

Download