discordrat | 85a287edb6eeb66eeada945ff71c946a76171be92244071c07d0ac5553d96cf2

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 03:33

Target

c053ebb3f0f90a7705729579d25dd194.exe
Size

78KB
MD5

c053ebb3f0f90a7705729579d25dd194
SHA1

fe045f0584ee3656af1e89a6ca37ef68e7f252a3
SHA256

85a287edb6eeb66eeada945ff71c946a76171be92244071c07d0ac5553d96cf2
SHA512

a5beac0ec0b1ecad655f52555ff83d756169335be383bd2dd4310b4e9d2120fb939ed42116554ae1544ed9db56a3846d6ca0369d2af0430a8d7c3717e2223854
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI0NzYzMjcxMjk1Nzk1NjE4Nw.G3MXNZ.B896PWyca43CGShZp7WvFVoaKLYOSP1no8IyaM
server_id
1247637478639271976

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c053ebb3f0f90a7705729579d25dd194.exe

description pid process

Token: SeDebugPrivilege 3024 c053ebb3f0f90a7705729579d25dd194.exe

description	pid	process
Token: SeDebugPrivilege	3024	c053ebb3f0f90a7705729579d25dd194.exe

C:\Users\Admin\AppData\Local\Temp\c053ebb3f0f90a7705729579d25dd194.exe
"C:\Users\Admin\AppData\Local\Temp\c053ebb3f0f90a7705729579d25dd194.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024

memory/3024-0-0x00000249C6410000-0x00000249C6428000-memory.dmp

Filesize
96KB

Download
memory/3024-1-0x00007FF8B1F83000-0x00007FF8B1F85000-memory.dmp

Filesize
8KB

Download
memory/3024-2-0x00000249E0A40000-0x00000249E0C02000-memory.dmp

Filesize
1.8MB

Download
memory/3024-3-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

Filesize
10.8MB

Download
memory/3024-4-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

Filesize
10.8MB

Download