discordrat | 8fb5c397bfd7f9782487f81a0b22804cfc9221aa3d1120761923aa94038ea4af

Resubmissions

27-06-2024 12:12

240627-pdplps1bkc 10

27-06-2024 12:10

240627-pb4mva1ale 10

27-06-2024 12:07

240627-pacgzasgrp 10

27-06-2024 12:03

240627-n8jhhasgkj 10

Analysis

max time kernel
149s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
27-06-2024 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

f1a1f289c33b5a94d9fb791b927a5659
SHA1

d88776df9e6f12b350cb289e37812cc531186624
SHA256

8fb5c397bfd7f9782487f81a0b22804cfc9221aa3d1120761923aa94038ea4af
SHA512

e7ce8d194d9b808a224d931131dd8fdd781a93ec765febab2b1a104d131f214059f197d6f09eb1b63345d84f55be06ce93fae12f5a7e992adb74ad05f5b01529
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+hPIC:5Zv5PDwbjNrmAE+xIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NTg1NDczODQ5MTE4MzEzNQ.GaXeok.R9V6gI6ppt9_tFVs1wCBBXJycp_2xYh8oTNn54
server_id
1255855590312382485

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

9 discord.com
10 discord.com
14 discord.com
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2364 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

2364 vlc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client-built.exe

description pid process

Token: SeDebugPrivilege 2840 Client-built.exe
Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

vlc.exe

pid process

2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

vlc.exe

pid process

2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
2364 vlc.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

xpsrchvw.exevlc.exe

pid process

5064 xpsrchvw.exe
5064 xpsrchvw.exe
5064 xpsrchvw.exe
5064 xpsrchvw.exe
2364 vlc.exe

flow	ioc
9	discord.com
10	discord.com
14	discord.com

pid	process
2364	vlc.exe

pid	process
2364	vlc.exe

description	pid	process
Token: SeDebugPrivilege	2840	Client-built.exe

pid	process
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe

pid	process
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe

pid	process
5064	xpsrchvw.exe
5064	xpsrchvw.exe
5064	xpsrchvw.exe
5064	xpsrchvw.exe
2364	vlc.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\xpsrchvw.exe
"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\NewRestart.xps"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DenyComplete.asf"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x00007FFF16C53000-0x00007FFF16C54000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x00000171F4B50000-0x00000171F4B68000-memory.dmp

Filesize
96KB

Download
memory/2840-2-0x00000171F7250000-0x00000171F7412000-memory.dmp

Filesize
1.8MB

Download
memory/2840-3-0x00007FFF16C50000-0x00007FFF1763C000-memory.dmp

Filesize
9.9MB

Download
memory/2840-4-0x00000171F7B50000-0x00000171F8076000-memory.dmp

Filesize
5.1MB

Download
memory/2840-5-0x00007FFF16C50000-0x00007FFF1763C000-memory.dmp

Filesize
9.9MB

Download