discordrat | f48cfcefdae5347a3b28636990ea7bf4a3913b25ead970549b2aed25ca126a2a

Analysis

max time kernel
121s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 14:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

a87de6c537a47d45a33d6cd7fe63c7d8
SHA1

7e6c0eeb273ff05cd0ceecf54a5eebf74eab3dfb
SHA256

f48cfcefdae5347a3b28636990ea7bf4a3913b25ead970549b2aed25ca126a2a
SHA512

594a952866609f288ce6f21359ca1a8e4e2452479b1ddca7b13de404816eaaf5f2bb4239889f3c4cc50a109cf862e92ad2e0e4a0f8425d98c8a7d0905b20df08
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC

Score

10^/10

discordrat execution persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1ODE0MjA5Mzg3NjkyMDM5MA.G8HI0H.--xk7lvmzg6lSm3Q38_QLfEurjVUDvUKfDsSp4
server_id
1258141390668435557

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3512 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service
T1102

Processes:

flow ioc

48 discord.com
62 discord.com
66 discord.com
67 discord.com
8 discord.com
23 discord.com
63 discord.com
80 discord.com
9 discord.com
49 discord.com
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3512 powershell.exe
3512 powershell.exe

pid	process
3512	powershell.exe

flow	ioc
48	discord.com
62	discord.com
66	discord.com
67	discord.com
8	discord.com
23	discord.com
63	discord.com
80	discord.com
9	discord.com
49	discord.com

pid	process
3512	powershell.exe
3512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Client-built.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4724	Client-built.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeShutdownPrivilege	4724	Client-built.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 4724 wrote to memory of 3512	4724	Client-built.exe	powershell.exe
PID 4724 wrote to memory of 3512	4724	Client-built.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wbdga1fw.gtd.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3512-23-0x00007FFD41B20000-0x00007FFD425E1000-memory.dmp

Filesize
10.8MB

Download
memory/3512-20-0x00007FFD41B20000-0x00007FFD425E1000-memory.dmp

Filesize
10.8MB

Download
memory/3512-19-0x00007FFD41B20000-0x00007FFD425E1000-memory.dmp

Filesize
10.8MB

Download
memory/3512-18-0x00007FFD41B20000-0x00007FFD425E1000-memory.dmp

Filesize
10.8MB

Download
memory/3512-17-0x00007FFD41B20000-0x00007FFD425E1000-memory.dmp

Filesize
10.8MB

Download
memory/3512-12-0x000001E03B6F0000-0x000001E03B712000-memory.dmp

Filesize
136KB

Download
memory/4724-3-0x00007FFD41B20000-0x00007FFD425E1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-6-0x00007FFD41B20000-0x00007FFD425E1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-5-0x00007FFD41B23000-0x00007FFD41B25000-memory.dmp

Filesize
8KB

Download
memory/4724-4-0x000001F7F1B20000-0x000001F7F2048000-memory.dmp

Filesize
5.2MB

Download
memory/4724-0-0x00007FFD41B23000-0x00007FFD41B25000-memory.dmp

Filesize
8KB

Download
memory/4724-2-0x000001F7F1220000-0x000001F7F13E2000-memory.dmp

Filesize
1.8MB

Download
memory/4724-1-0x000001F7EEBF0000-0x000001F7EEC08000-memory.dmp

Filesize
96KB

Download