Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
04-07-2024 21:05
General
-
Target
RadScript-LTM.exe
-
Size
78KB
-
MD5
ed3336cb4bf8338766b3837b8ef15c60
-
SHA1
2aa00d65d40296d8e528dc2e4a2b70ffe4fa0bc0
-
SHA256
3a47516a9aa240ff0699be768a97cdbd5c6a6a2ae0914c4da05e96fa509d19b6
-
SHA512
733c9d092d295d0b1b3356feda27ea7241571236221c3a5b586a21ba87e10a0026cb7cb1feadafdb17930789917e98815f754145f565416b8167fea5852b3091
-
SSDEEP
1536:wIQOI8S4zTMHFEOEGZefHeKrIX8amErwbjNrB+uexCroKV6+fd6:wIq8S4nMLeGKrIX8amcwbjNrB+xSd6
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0ODA5NTUwMzU2MDczNjgyOQ.GDa56t.9JQ8X9M_IhzNN2OonxifeOaAfNRq8mv0dYTIRc
-
server_id
1221950436458893433
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RadScript-LTM.exe"C:\Users\Admin\AppData\Local\Temp\RadScript-LTM.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1396-0-0x000002B66F4E0000-0x000002B66F4F8000-memory.dmpFilesize
96KB
-
memory/1396-1-0x00007FFBBD923000-0x00007FFBBD925000-memory.dmpFilesize
8KB
-
memory/1396-2-0x000002B671AF0000-0x000002B671CB2000-memory.dmpFilesize
1.8MB
-
memory/1396-3-0x00007FFBBD920000-0x00007FFBBE3E1000-memory.dmpFilesize
10.8MB
-
memory/1396-4-0x000002B672430000-0x000002B672958000-memory.dmpFilesize
5.2MB
-
memory/1396-5-0x00007FFBBD923000-0x00007FFBBD925000-memory.dmpFilesize
8KB
-
memory/1396-6-0x00007FFBBD920000-0x00007FFBBE3E1000-memory.dmpFilesize
10.8MB