Overview

overview

10

Static

static

10

66cbb4776e...ce.exe

windows7-x64

10

66cbb4776e...ce.exe

windows10-2004-x64

10

Resubmissions

23-06-2024 23:29

240623-3gnqga1fln 10

23-06-2024 22:30

240623-2et9ssvgkc 10

Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2024 23:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe

  • Size

    78KB

  • MD5

    01ada4c5d09fec1f9fbe503e1236253c

  • SHA1

    b55d8fc3ba0efa1b2cfdf39103031bc7476b208d

  • SHA256

    66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce

  • SHA512

    aec7493bb9efa11e6e65708eb7be37329bdfc93bc119410f8ecdfa6de9e1e9db9c250eea6617852c3e1ef0f23977cd53978187e498c6a446e0f39176590cf88c

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+UPIC:5Zv5PDwbjNrmAE+IIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI1MzY2NzkzMTcwMzc0MjQ3NA.GAS6tu.j9MK0FmUah1Hrzwqu4CSCBB7ZoOlp1sSBJGGw0

  • server_id

    1250682422434074634

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
    "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4308
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3704
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3120
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3600
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3740
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4616
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1636
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:544
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4564
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
      "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
      1⤵
        PID:3116
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2928
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5020
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4396
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2976
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1992
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1796
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1520
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4308
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3248
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5020
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2196
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1028
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1212
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3544
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3664
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2456
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4144
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2872
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2196
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1272
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4804
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3544
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3132
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4008
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1924
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:372
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4480
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1976
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3076
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1120
      • C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
        "C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4180

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3120-5-0x00007FFA29FC3000-0x00007FFA29FC5000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3120-6-0x00007FFA29FC0000-0x00007FFA2AA81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3120-7-0x00007FFA29FC0000-0x00007FFA2AA81000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4308-1-0x0000020C179C0000-0x0000020C179D8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/4308-0-0x00007FFA2B193000-0x00007FFA2B195000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4308-2-0x0000020C31F70000-0x0000020C32132000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/4308-3-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4308-4-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

        Filesize

        10.8MB

        Download