Resubmissions
25/06/2024, 14:37
240625-ry7dcsydrk1025/06/2024, 09:44
240625-lqpwfsscnc25/06/2024, 00:26
240625-arelbstdjr10Analysis
- max time kernel
92s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/06/2024, 00:26
General
- Target yjnclient-v3.exe
- Size 78KB
- Sample240625-arelbstdjr
- SHA256 6624c79c2c07fbcb8d4244fadd4e16ad4c536c187c25acaf3b831fff7cbda3c9
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI1NDkyMzczMDE3ODY3NDgwMw.GNKnH3._2hi153EQeLcF4SWSwr0pQuzH__TVonJih1mFM
-
server_id
1254923576340119644
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\yjnclient-v3.exe"C:\Users\Admin\AppData\Local\Temp\yjnclient-v3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1900-0-0x00007FFEEE1A3000-0x00007FFEEE1A5000-memory.dmp
memory/1900-1-0x000001C586540000-0x000001C586558000-memory.dmp
memory/1900-2-0x000001C5A0BF0000-0x000001C5A0DB2000-memory.dmp
memory/1900-3-0x00007FFEEE1A0000-0x00007FFEEEC61000-memory.dmp
memory/1900-4-0x000001C5A13F0000-0x000001C5A1918000-memory.dmp
memory/1900-5-0x00007FFEEE1A3000-0x00007FFEEE1A5000-memory.dmp
memory/1900-6-0x00007FFEEE1A0000-0x00007FFEEEC61000-memory.dmp