Analysis
-
max time kernel
36s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
28-06-2024 10:53
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240611-en
2 signatures
1800 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
a5a901355ccd33eadb9bb122bc14176d
-
SHA1
6201e657cc18db90ccfb0e882c32a24db0c18e5b
-
SHA256
2d274097dcb4ae2cb9b44f39b91e8ce2e679074a9821f7fbafd370d96b5337fa
-
SHA512
6c3195935632eefa803117ee3132fbf8ccbe1e356c0e78636523cfbf684dca812e47b373386b181a29bde682301deed76581bdaec1a86b046cb0cd34990e7e2b
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+BPIC:5Zv5PDwbjNrmAE+RIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NjE5NDgyNzA1MDAyOTA1Nw.G3AqjE.UHAhFs3PxA0V_Bfj5BG6Afk9X7v1oh-EvJQYw8
-
server_id
1256194611148230688
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exeClient-built.exedescription pid process Token: SeDebugPrivilege 4100 Client-built.exe Token: SeDebugPrivilege 1508 Client-built.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Client-built.exe"C:\Users\Admin\Desktop\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-6-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmpFilesize
9.9MB
-
memory/1508-7-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmpFilesize
9.9MB
-
memory/4100-1-0x00007FFF8BF33000-0x00007FFF8BF34000-memory.dmpFilesize
4KB
-
memory/4100-0-0x000001F01CE40000-0x000001F01CE58000-memory.dmpFilesize
96KB
-
memory/4100-2-0x000001F0373C0000-0x000001F037582000-memory.dmpFilesize
1.8MB
-
memory/4100-3-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmpFilesize
9.9MB
-
memory/4100-4-0x000001F037BF0000-0x000001F038116000-memory.dmpFilesize
5.1MB
-
memory/4100-5-0x00007FFF8BF30000-0x00007FFF8C91C000-memory.dmpFilesize
9.9MB