discordrat | 3166ca8bc5b981c157a6793150b4e99de9f5741dd6e14af9b1fcfa8c052f7ce7

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe
Size

78KB
MD5

9424d6ca1fc2ce929e79b5a8d8d3c650
SHA1

9a2c006699b50d5c9e4f7b73fa64f99f7622224e
SHA256

3166ca8bc5b981c157a6793150b4e99de9f5741dd6e14af9b1fcfa8c052f7ce7
SHA512

68dbab8c15f8944e8bccb6fb942f176134654a3cd644e8957b723d65197381a9ff97ef0f9e24d57008f5b14b39270cd9c7fa78674605c9f5d6e236fd7eee2487
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nJPIC:5Zv5PDwbjNrmAE+n5IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1MTE1NTAyMTY5MzcxNDQ5NA.GgQ1ag.AF8zd5W06EJvUkTZSulHyzFeNNpxflm0gfgJBs
server_id
1251156859554103347

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

15 discord.com
16 discord.com
21 discord.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe

description pid process

Token: SeDebugPrivilege 4280 9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe

flow	ioc
15	discord.com
16	discord.com
21	discord.com

description	pid	process
Token: SeDebugPrivilege	4280	9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4280-0-0x000001F047810000-0x000001F047828000-memory.dmp

Filesize
96KB

Download
memory/4280-1-0x00007FFA73BC3000-0x00007FFA73BC5000-memory.dmp

Filesize
8KB

Download
memory/4280-2-0x000001F061F40000-0x000001F062102000-memory.dmp

Filesize
1.8MB

Download
memory/4280-3-0x00007FFA73BC0000-0x00007FFA74681000-memory.dmp

Filesize
10.8MB

Download
memory/4280-4-0x000001F062740000-0x000001F062C68000-memory.dmp

Filesize
5.2MB

Download
memory/4280-5-0x00007FFA73BC3000-0x00007FFA73BC5000-memory.dmp

Filesize
8KB

Download
memory/4280-6-0x00007FFA73BC0000-0x00007FFA74681000-memory.dmp

Filesize
10.8MB

Download