Analysis Overview
SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
Threat Level: Known bad
The file release.zip was found to be: Known bad.
Malicious Activity Summary
Discordrat family
Discord RAT
Executes dropped EXE
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-28 10:23
Signatures
Discordrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-28 10:23
Reported
2024-06-28 10:43
Platform
win7-20240419-en
Max time kernel
841s
Max time network
843s
Command Line
Signatures
Discord RAT
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 992 wrote to memory of 2092 | N/A | C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe | C:\Windows\system32\WerFault.exe |
| PID 992 wrote to memory of 2092 | N/A | C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe | C:\Windows\system32\WerFault.exe |
| PID 992 wrote to memory of 2092 | N/A | C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 992 -s 596
Network
Files
memory/992-0-0x000007FEF51B3000-0x000007FEF51B4000-memory.dmp
memory/992-1-0x000000013F240000-0x000000013F258000-memory.dmp
memory/992-2-0x000007FEF51B0000-0x000007FEF5B9C000-memory.dmp
memory/992-3-0x000007FEF51B0000-0x000007FEF5B9C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-28 10:23
Reported
2024-06-28 10:43
Platform
win10v2004-20240611-en
Max time kernel
453s
Max time network
1177s
Command Line
Signatures
Discord RAT
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 162.159.136.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.136.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| BE | 88.221.83.227:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 227.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.173.189.20.in-addr.arpa | udp |
Files
memory/640-0-0x00007FFCAB903000-0x00007FFCAB905000-memory.dmp
memory/640-1-0x000002578EF20000-0x000002578EF38000-memory.dmp
memory/640-2-0x00000257A94C0000-0x00000257A9682000-memory.dmp
memory/640-3-0x00007FFCAB900000-0x00007FFCAC3C1000-memory.dmp
memory/640-4-0x00000257A9CC0000-0x00000257AA1E8000-memory.dmp
memory/640-5-0x00007FFCAB900000-0x00007FFCAC3C1000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-28 10:23
Reported
2024-06-28 10:43
Platform
win7-20240508-en
Max time kernel
841s
Max time network
846s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder.exe"
C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
Network
Files
memory/2432-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp
memory/2432-1-0x0000000000040000-0x0000000000048000-memory.dmp
memory/2432-2-0x0000000074A20000-0x000000007510E000-memory.dmp
memory/2432-3-0x0000000074A2E000-0x0000000074A2F000-memory.dmp
memory/2432-4-0x0000000074A20000-0x000000007510E000-memory.dmp
memory/2432-5-0x0000000005D80000-0x0000000005EA2000-memory.dmp
Analysis: behavioral4
Detonation Overview
Submitted
2024-06-28 10:23
Reported
2024-06-28 10:26
Platform
win10v2004-20240508-en
Max time kernel
163s
Max time network
167s
Command Line
Signatures
Discord RAT
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\Client-built.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Desktop\Client-built.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder.exe"
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
Files
memory/4460-0-0x00000000747DE000-0x00000000747DF000-memory.dmp
memory/4460-1-0x0000000000DA0000-0x0000000000DA8000-memory.dmp
memory/4460-2-0x0000000005C60000-0x0000000006204000-memory.dmp
memory/4460-3-0x0000000005790000-0x0000000005822000-memory.dmp
memory/4460-4-0x0000000005940000-0x000000000594A000-memory.dmp
memory/4460-5-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/4460-6-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/4460-7-0x0000000001530000-0x0000000001652000-memory.dmp
C:\Users\Admin\Desktop\Client-built.exe
| MD5 | 5fa78b19ae158350ead3ef50feb6a7a2 |
| SHA1 | 57d57ca525968fd9d5a9ee38e783e288896caa01 |
| SHA256 | 1d4914ee768fbaf1b82a860ace972a01338c12a05ff7dbdde42bfab43b21a4d5 |
| SHA512 | c0d0803b5ceaa4c3013132ead8d8a95faae4a01933c41cb4c998572c2a31c971faab5bb2c488aee8d73a16a0037a78e09130e1ecd2804c40f0665399c404c00e |
memory/1576-11-0x000001DE69020000-0x000001DE69038000-memory.dmp
memory/1576-12-0x00007FFBA1273000-0x00007FFBA1275000-memory.dmp
memory/1576-13-0x000001DE6B6C0000-0x000001DE6B882000-memory.dmp
memory/1576-14-0x00007FFBA1270000-0x00007FFBA1D31000-memory.dmp
Analysis: behavioral5
Detonation Overview
Submitted
2024-06-28 10:23
Reported
2024-06-28 10:44
Platform
win7-20240508-en
Max time kernel
840s
Max time network
846s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dnlib.dll,#1
Network
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-06-28 10:23
Reported
2024-06-28 10:43
Platform
win10v2004-20240611-en
Max time kernel
448s
Max time network
1170s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dnlib.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| BE | 88.221.83.235:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.173.189.20.in-addr.arpa | udp |