discordrat | c902d6571697ad044ac2c0090d522d115d3e06ab672ca355e3d9085b6c77e304

Analysis

max time kernel
23s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PanelExecutor-Fixer.exe
Size

78KB
MD5

e265a5b1fe4e46c72e018e5b7376563e
SHA1

c45441fe1c0b431ad69915c3242398a16f8c19bb
SHA256

c902d6571697ad044ac2c0090d522d115d3e06ab672ca355e3d9085b6c77e304
SHA512

8b1a9f0068ffb499dd02392f6eb4fb7e16c84b23932c8b6d5e6c12512c8370f1466eda856181045fe4f0addbac0f231f3ac78219a565752db963be19dc46e5b5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+1PIC:5Zv5PDwbjNrmAE+lIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1ODY0ODcyMTY2MzU5MDQzMA.GiwjRC.iYf3r79g3-ZKRAfGjtWZw33DYNFg759sGho8y8
server_id
1247781121165623369

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
5	discord.com
6	discord.com
15	discord.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	PanelExecutor-Fixer.exe

C:\Users\Admin\AppData\Local\Temp\PanelExecutor-Fixer.exe
"C:\Users\Admin\AppData\Local\Temp\PanelExecutor-Fixer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4320,i,18267267250369716772,14567143188126594249,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:8
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-0-0x0000024E27670000-0x0000024E27688000-memory.dmp

Filesize
96KB

Download
memory/1868-1-0x00007FFE2A9A3000-0x00007FFE2A9A5000-memory.dmp

Filesize
8KB

Download
memory/1868-2-0x0000024E41C90000-0x0000024E41E52000-memory.dmp

Filesize
1.8MB

Download
memory/1868-3-0x00007FFE2A9A0000-0x00007FFE2B461000-memory.dmp

Filesize
10.8MB

Download
memory/1868-4-0x0000024E42490000-0x0000024E429B8000-memory.dmp

Filesize
5.2MB

Download
memory/1868-5-0x00007FFE2A9A3000-0x00007FFE2A9A5000-memory.dmp

Filesize
8KB

Download