Overview

overview

10

Static

static

10

9bcaf3dbe9...1a.exe

windows7-x64

10

9bcaf3dbe9...1a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2024 01:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9bcaf3dbe98611f6cda0aa2e225777401746a802e53bd4b48f3d11637ed19c1a.exe

  • Size

    78KB

  • MD5

    a5d78ceca0d1cf4f7c01570f52c87eba

  • SHA1

    79a51625c12e3dc18f0df104e4b69c390780642a

  • SHA256

    9bcaf3dbe98611f6cda0aa2e225777401746a802e53bd4b48f3d11637ed19c1a

  • SHA512

    ce2fa48229eae4ee7ea6e707de5c244b9a645735731d2c9174bb65e272380b109ea709eac1c20fc5b5e004af0e340c44827a488b217ac14787ef4cc33a3cbc3f

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI1ODA5NjQzNzA2MjAwOTA2NQ.GhJzhd.kk9R2GDudIgunSijVjaWQD6sIwY3-Lvdx3K_jA

  • server_id

    1258096259378577508

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bcaf3dbe98611f6cda0aa2e225777401746a802e53bd4b48f3d11637ed19c1a.exe
    "C:\Users\Admin\AppData\Local\Temp\9bcaf3dbe98611f6cda0aa2e225777401746a802e53bd4b48f3d11637ed19c1a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2468-0-0x00007FF812DF3000-0x00007FF812DF5000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2468-1-0x00000260E6E50000-0x00000260E6E68000-memory.dmp
    Filesize

    96KB

    Download
  • memory/2468-2-0x00000260E9400000-0x00000260E95C2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/2468-3-0x00007FF812DF0000-0x00007FF8138B1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/2468-4-0x00000260E9C40000-0x00000260EA168000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/2468-5-0x00007FF812DF3000-0x00007FF812DF5000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2468-6-0x00007FF812DF0000-0x00007FF8138B1000-memory.dmp
    Filesize

    10.8MB

    Download