Overview

overview

10

Static

static

10

Release/Di...at.exe

windows7-x64

10

Release/Di...at.exe

windows10-2004-x64

10

builder.exe

windows7-x64

1

builder.exe

windows10-2004-x64

10

dnlib.dll

windows7-x64

1

dnlib.dll

windows10-2004-x64

1

Resubmissions

28-06-2024 10:43

240628-msnxlsxgkp 10

28-06-2024 10:23

240628-me273sthpg 10

Analysis

  • max time kernel
    163s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 10:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    builder.exe

  • Size

    10KB

  • MD5

    4f04f0e1ff050abf6f1696be1e8bb039

  • SHA1

    bebf3088fff4595bfb53aea6af11741946bbd9ce

  • SHA256

    ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa

  • SHA512

    94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12

  • SSDEEP

    96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Executes dropped EXE 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\builder.exe
    "C:\Users\Admin\AppData\Local\Temp\builder.exe"
    1⤵
      PID:4460
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3972
      • C:\Users\Admin\Desktop\Client-built.exe
        "C:\Users\Admin\Desktop\Client-built.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1576

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\Client-built.exe
        Filesize

        78KB

        MD5

        5fa78b19ae158350ead3ef50feb6a7a2

        SHA1

        57d57ca525968fd9d5a9ee38e783e288896caa01

        SHA256

        1d4914ee768fbaf1b82a860ace972a01338c12a05ff7dbdde42bfab43b21a4d5

        SHA512

        c0d0803b5ceaa4c3013132ead8d8a95faae4a01933c41cb4c998572c2a31c971faab5bb2c488aee8d73a16a0037a78e09130e1ecd2804c40f0665399c404c00e

        Download Submit
      • memory/1576-14-0x00007FFBA1270000-0x00007FFBA1D31000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/1576-13-0x000001DE6B6C0000-0x000001DE6B882000-memory.dmp
        Filesize

        1.8MB

        Download
      • memory/1576-12-0x00007FFBA1273000-0x00007FFBA1275000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1576-11-0x000001DE69020000-0x000001DE69038000-memory.dmp
        Filesize

        96KB

        Download
      • memory/4460-3-0x0000000005790000-0x0000000005822000-memory.dmp
        Filesize

        584KB

        Download
      • memory/4460-6-0x00000000747D0000-0x0000000074F80000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/4460-7-0x0000000001530000-0x0000000001652000-memory.dmp
        Filesize

        1.1MB

        Download
      • memory/4460-5-0x00000000747D0000-0x0000000074F80000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/4460-4-0x0000000005940000-0x000000000594A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/4460-0-0x00000000747DE000-0x00000000747DF000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4460-2-0x0000000005C60000-0x0000000006204000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/4460-1-0x0000000000DA0000-0x0000000000DA8000-memory.dmp
        Filesize

        32KB

        Download