discordrat | c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

Analysis

max time kernel
96s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

builder.exe
Size

10KB
MD5

4f04f0e1ff050abf6f1696be1e8bb039
SHA1

bebf3088fff4595bfb53aea6af11741946bbd9ce
SHA256

ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
SHA512

94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
SSDEEP

96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Executes dropped EXE 2 IoCs

Processes:

Client-built.exeClient-built.exe

pid process

3892 Client-built.exe
1324 Client-built.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient-built.exe

description pid process

Token: SeDebugPrivilege 3892 Client-built.exe
Token: SeDebugPrivilege 1324 Client-built.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

builder.exe

pid process

4724 builder.exe
4724 builder.exe
4724 builder.exe

pid	process
3892	Client-built.exe
1324	Client-built.exe

description	pid	process
Token: SeDebugPrivilege	3892	Client-built.exe
Token: SeDebugPrivilege	1324	Client-built.exe

pid	process
4724	builder.exe
4724	builder.exe
4724	builder.exe

C:\Users\Admin\AppData\Local\Temp\builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4964

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Client-built.exe
Filesize
78KB

MD5
5fa78b19ae158350ead3ef50feb6a7a2

SHA1
57d57ca525968fd9d5a9ee38e783e288896caa01

SHA256
1d4914ee768fbaf1b82a860ace972a01338c12a05ff7dbdde42bfab43b21a4d5

SHA512
c0d0803b5ceaa4c3013132ead8d8a95faae4a01933c41cb4c998572c2a31c971faab5bb2c488aee8d73a16a0037a78e09130e1ecd2804c40f0665399c404c00e

Download Submit
memory/3892-20-0x00007FFA921C0000-0x00007FFA92C81000-memory.dmp

Filesize
10.8MB

Download
memory/3892-16-0x00007FFA921C0000-0x00007FFA92C81000-memory.dmp

Filesize
10.8MB

Download
memory/3892-15-0x0000011A31920000-0x0000011A31AE2000-memory.dmp

Filesize
1.8MB

Download
memory/3892-14-0x0000011A172F0000-0x0000011A17308000-memory.dmp

Filesize
96KB

Download
memory/3892-13-0x00007FFA921C3000-0x00007FFA921C5000-memory.dmp

Filesize
8KB

Download
memory/4724-4-0x0000000005610000-0x000000000561A000-memory.dmp

Filesize
40KB

Download
memory/4724-9-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download
memory/4724-10-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/4724-6-0x00000000069F0000-0x0000000006B12000-memory.dmp

Filesize
1.1MB

Download
memory/4724-5-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/4724-0-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download
memory/4724-3-0x0000000005660000-0x00000000056F2000-memory.dmp

Filesize
584KB

Download
memory/4724-2-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download
memory/4724-18-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/4724-1-0x0000000000C10000-0x0000000000C18000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads