Analysis Overview
SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
Threat Level: Known bad
The file release.zip was found to be: Known bad.
Malicious Activity Summary
Discordrat family
Discord RAT
Executes dropped EXE
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-10 17:44
Signatures
Discordrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-10 17:44
Reported
2024-06-10 17:47
Platform
win10v2004-20240508-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Discord RAT
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
Files
memory/3752-0-0x000001E0148B0000-0x000001E0148C8000-memory.dmp
memory/3752-2-0x00007FFFBA0D3000-0x00007FFFBA0D5000-memory.dmp
memory/3752-1-0x000001E02F0A0000-0x000001E02F262000-memory.dmp
memory/3752-3-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp
memory/3752-4-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-10 17:44
Reported
2024-06-10 17:46
Platform
win10v2004-20240508-en
Max time kernel
96s
Max time network
105s
Command Line
Signatures
Discord RAT
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\Client-built.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\Client-built.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Desktop\Client-built.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Desktop\Client-built.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\builder.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\builder.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\builder.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder.exe"
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
Files
memory/4724-0-0x00000000752AE000-0x00000000752AF000-memory.dmp
memory/4724-1-0x0000000000C10000-0x0000000000C18000-memory.dmp
memory/4724-2-0x0000000005C10000-0x00000000061B4000-memory.dmp
memory/4724-3-0x0000000005660000-0x00000000056F2000-memory.dmp
memory/4724-4-0x0000000005610000-0x000000000561A000-memory.dmp
memory/4724-5-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/4724-6-0x00000000069F0000-0x0000000006B12000-memory.dmp
memory/4724-9-0x00000000752AE000-0x00000000752AF000-memory.dmp
memory/4724-10-0x00000000752A0000-0x0000000075A50000-memory.dmp
C:\Users\Admin\Desktop\Client-built.exe
| MD5 | 5fa78b19ae158350ead3ef50feb6a7a2 |
| SHA1 | 57d57ca525968fd9d5a9ee38e783e288896caa01 |
| SHA256 | 1d4914ee768fbaf1b82a860ace972a01338c12a05ff7dbdde42bfab43b21a4d5 |
| SHA512 | c0d0803b5ceaa4c3013132ead8d8a95faae4a01933c41cb4c998572c2a31c971faab5bb2c488aee8d73a16a0037a78e09130e1ecd2804c40f0665399c404c00e |
memory/3892-13-0x00007FFA921C3000-0x00007FFA921C5000-memory.dmp
memory/3892-14-0x0000011A172F0000-0x0000011A17308000-memory.dmp
memory/3892-15-0x0000011A31920000-0x0000011A31AE2000-memory.dmp
memory/3892-16-0x00007FFA921C0000-0x00007FFA92C81000-memory.dmp
memory/4724-18-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/3892-20-0x00007FFA921C0000-0x00007FFA92C81000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-10 17:44
Reported
2024-06-10 17:47
Platform
win10v2004-20240508-en
Max time kernel
147s
Max time network
152s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dnlib.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |