Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
17-06-2024 17:50
General
-
Target
builder.exe
-
Size
78KB
-
MD5
5680a6247bf2ac6bd97f463863b3790c
-
SHA1
6a18553f769b60cc23b7fe5c87f3fcc1de060d36
-
SHA256
6fbb1c25814dd749fb423bc4f9bca99919030278a27ca09b9f997b3ef84d3c1d
-
SHA512
9ccdd13ab4d40542c4f38c6cee4553d7179d08b7e4926170fb582a6f6303e9c2358538f2b5b936e3112943b0df394c08350cc4b35e64c93c2831a8ceec738a18
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC
Malware Config
Extracted
discordrat
-
discord_token
MTI1MTE4NjM4OTk1MzgxMDQ5NQ.GcIZgp.AMqtZCZqZtUob-d3gzU2LOM5ax5FJRSnHAEFIA
-
server_id
1250120108064378900
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\builder.exe"C:\Users\Admin\AppData\Local\Temp\builder.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5e9aa12ff0be6d995ed86f8cf88678158
SHA1e5ee38fc2ebef0fcbc3059dee29b39f7daf21931
SHA256f35cd8ef03ac924a59943c5dfffc31ab67a8b5aff272e9f47ff776aabc7ee561
SHA51295a67acd2a4784b87d73910c1f1f590937c9d9b901e98448556a37eb8137ae5f458f1c673d65a46cf7d6b90bee5fe6b102ce3eeac9e819062cd9c5c2418bcbfc
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB