discordrat | de835849dd473a5d7baf4feb097f3ea9bac30e42a220e7f97a3cc25845378b9e

Resubmissions

23-06-2024 19:39

17-06-2024 14:08

max time kernel
50s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 19:39

Target

7778/Release/Discord rat.exe
Size

79KB
MD5

d13905e018eb965ded2e28ba0ab257b5
SHA1

6d7fe69566fddc69b33d698591c9a2c70d834858
SHA256

2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512

b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP

1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU

Score

10^/10

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

Discord rat.exeDiscord rat.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	5088	Discord rat.exe
Token: SeDebugPrivilege	468	Discord rat.exe
Token: SeBackupPrivilege	744	svchost.exe
Token: SeRestorePrivilege	744	svchost.exe
Token: SeSecurityPrivilege	744	svchost.exe
Token: SeTakeOwnershipPrivilege	744	svchost.exe
Token: 35	744	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7778\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\7778\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\7778\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\7778\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:744

memory/468-5-0x00007FFDB1173000-0x00007FFDB1175000-memory.dmp

Filesize
8KB

Download
memory/468-6-0x00007FFDB1170000-0x00007FFDB1C31000-memory.dmp

Filesize
10.8MB

Download
memory/468-7-0x00007FFDB1170000-0x00007FFDB1C31000-memory.dmp

Filesize
10.8MB

Download
memory/5088-0-0x00007FFDB32A3000-0x00007FFDB32A5000-memory.dmp

Filesize
8KB

Download
memory/5088-1-0x000001EF07C90000-0x000001EF07CA8000-memory.dmp

Filesize
96KB

Download
memory/5088-2-0x000001EF22360000-0x000001EF22522000-memory.dmp

Filesize
1.8MB

Download
memory/5088-3-0x00007FFDB32A0000-0x00007FFDB3D61000-memory.dmp

Filesize
10.8MB

Download
memory/5088-4-0x00007FFDB32A0000-0x00007FFDB3D61000-memory.dmp

Filesize
10.8MB

Download