Analysis
-
max time kernel
163s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28-06-2024 10:23
General
-
Target
builder.exe
-
Size
10KB
-
MD5
4f04f0e1ff050abf6f1696be1e8bb039
-
SHA1
bebf3088fff4595bfb53aea6af11741946bbd9ce
-
SHA256
ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
-
SHA512
94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
-
SSDEEP
96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Executes dropped EXE 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\builder.exe"C:\Users\Admin\AppData\Local\Temp\builder.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Client-built.exe"C:\Users\Admin\Desktop\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD55fa78b19ae158350ead3ef50feb6a7a2
SHA157d57ca525968fd9d5a9ee38e783e288896caa01
SHA2561d4914ee768fbaf1b82a860ace972a01338c12a05ff7dbdde42bfab43b21a4d5
SHA512c0d0803b5ceaa4c3013132ead8d8a95faae4a01933c41cb4c998572c2a31c971faab5bb2c488aee8d73a16a0037a78e09130e1ecd2804c40f0665399c404c00e
-
Filesize
10.8MB
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
32KB