Analysis
-
max time kernel
55s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 10:09
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240611-en
Errors
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
c1f71798dffa8e4a4ab805c27a789ea8
-
SHA1
8c2f701fd09b8a7cd7765250ac5c6076ad0b1250
-
SHA256
152c8a1df21658fb6b56fe83980ad12ae4b09aba7dbe79f81fadf6cfcb053ef3
-
SHA512
77744fb33cb7367aa2f1693cb4808e0c4dc9fdd87f14b2f5ff249715f23d2e21b5e16d016eb23a51e8325c343432a4ff2796f34008fec64e891de3509bf1722e
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WPIC:5Zv5PDwbjNrmAE+SIC
Malware Config
Extracted
discordrat
-
discord_token
MTI1ODE0MjA5Mzg3NjkyMDM5MA.GAqldV.Jkaqx512oGC1RwKsIEnN3OyqOR-KslMi0wNe18
-
server_id
1258141390668435557
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
Processes:
flow ioc 11 discord.com 36 discord.com 37 discord.com 38 discord.com 53 raw.githubusercontent.com 54 discord.com 9 discord.com 24 discord.com 35 discord.com 52 raw.githubusercontent.com 55 discord.com -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exedescription pid process Token: SeDebugPrivilege 2124 Client-built.exe Token: SeShutdownPrivilege 2124 Client-built.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2124-1-0x00007FFCAC8A3000-0x00007FFCAC8A5000-memory.dmpFilesize
8KB
-
memory/2124-0-0x0000021BC2680000-0x0000021BC2698000-memory.dmpFilesize
96KB
-
memory/2124-2-0x0000021BDCDC0000-0x0000021BDCF82000-memory.dmpFilesize
1.8MB
-
memory/2124-3-0x00007FFCAC8A0000-0x00007FFCAD361000-memory.dmpFilesize
10.8MB
-
memory/2124-4-0x0000021BDD5C0000-0x0000021BDDAE8000-memory.dmpFilesize
5.2MB
-
memory/2124-5-0x00007FFCAC8A3000-0x00007FFCAC8A5000-memory.dmpFilesize
8KB
-
memory/2124-6-0x00007FFCAC8A0000-0x00007FFCAD361000-memory.dmpFilesize
10.8MB
-
memory/2124-7-0x0000021BDEBA0000-0x0000021BDEE6A000-memory.dmpFilesize
2.8MB