discordrat | 8fb5c397bfd7f9782487f81a0b22804cfc9221aa3d1120761923aa94038ea4af

Resubmissions

27-06-2024 12:12

240627-pdplps1bkc 10

27-06-2024 12:10

240627-pb4mva1ale 10

27-06-2024 12:07

240627-pacgzasgrp 10

27-06-2024 12:03

240627-n8jhhasgkj 10

Analysis

max time kernel
149s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
27-06-2024 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

f1a1f289c33b5a94d9fb791b927a5659
SHA1

d88776df9e6f12b350cb289e37812cc531186624
SHA256

8fb5c397bfd7f9782487f81a0b22804cfc9221aa3d1120761923aa94038ea4af
SHA512

e7ce8d194d9b808a224d931131dd8fdd781a93ec765febab2b1a104d131f214059f197d6f09eb1b63345d84f55be06ce93fae12f5a7e992adb74ad05f5b01529
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+hPIC:5Zv5PDwbjNrmAE+xIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NTg1NDczODQ5MTE4MzEzNQ.GaXeok.R9V6gI6ppt9_tFVs1wCBBXJycp_2xYh8oTNn54
server_id
1255855590312382485

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	discord.com
10	discord.com
14	discord.com

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2364	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	vlc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	Client-built.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe
2364	vlc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5064	xpsrchvw.exe
5064	xpsrchvw.exe
5064	xpsrchvw.exe
5064	xpsrchvw.exe
2364	vlc.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\xpsrchvw.exe
"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\NewRestart.xps"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DenyComplete.asf"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control