Analysis
-
max time kernel
192s -
max time network
203s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
-
submitted
01-07-2024 22:31
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
81b4f7b3c21e9459c88e5d1a2d8867a1
-
SHA1
fe7aedbfab5af87c5eb16e4d5e161a264ed9169a
-
SHA256
af5161915de18971830fdf24db4077b273c0bfc9ea0c749b3bc27c1eced7e488
-
SHA512
7fa82a302ec3fcc44fdc1fc97112123d03411cb3c4520041ea309fddf248ae13f5b919aa98dc6ebb79be5acb0fe9ecccc9393a86cdaf908fd6fd4697005e017e
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+lPIC:5Zv5PDwbjNrmAE+1IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NzM4NDc4Mzg1NjY2NDYzNw.Glmv_4.ZHfk_wkqNC8gaumJF072qPt_KqLkHsNKFnPsis
-
server_id
1257131081774141470
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1480-0-0x0000022081F80000-0x0000022081F98000-memory.dmpFilesize
96KB
-
memory/1480-1-0x00007FF961CF3000-0x00007FF961CF5000-memory.dmpFilesize
8KB
-
memory/1480-2-0x000002209C680000-0x000002209C842000-memory.dmpFilesize
1.8MB
-
memory/1480-3-0x00007FF961CF0000-0x00007FF9627B2000-memory.dmpFilesize
10.8MB
-
memory/1480-4-0x000002209D900000-0x000002209DE28000-memory.dmpFilesize
5.2MB
-
memory/1480-5-0x00007FF961CF0000-0x00007FF9627B2000-memory.dmpFilesize
10.8MB
-
memory/1480-7-0x00007FF961CF0000-0x00007FF9627B2000-memory.dmpFilesize
10.8MB