discordrat | 3eda8de3fca606c90d36e6f1148b0c78eac42ed532c182dfe3c5214bd03da032

Resubmissions

08-07-2024 06:23

240708-g5mmesycqh 10

08-07-2024 06:21

240708-g4vlmswfnk 10

08-07-2024 06:20

240708-g351zsycka 10

08-07-2024 06:17

240708-g2bezsybmf 10

Analysis

max time kernel
315s
max time network
1781s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08-07-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

8cce5e63c8cefaf423b2f34978fe67ed
SHA1

dfff7fc992ea0c6e765210fb58983ee833cb2177
SHA256

3eda8de3fca606c90d36e6f1148b0c78eac42ed532c182dfe3c5214bd03da032
SHA512

5f8392106cb5b4e59aa0ce5ce4cb8227f682df7afdb6fa288e876a0954dfe6452a75e1adc78d5f6a9a093949f05b6606e88c5cbfcfca93037e2433dc18ab0371
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1OTc1MzM2OTYwNjU1Nzc4Nw.GoiytD.R0INqYQ4iYfEi_aMf5nQz0adqWU9PKjBfAUqaM
server_id
1259753103436156978

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 discord.com
4 discord.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client-built.exe

description pid process

Token: SeDebugPrivilege 1964 Client-built.exe

flow	ioc
3	discord.com
4	discord.com

description	pid	process
Token: SeDebugPrivilege	1964	Client-built.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-0-0x00007FFFE8123000-0x00007FFFE8124000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x000001D8899B0000-0x000001D8899C8000-memory.dmp

Filesize
96KB

Download
memory/1964-2-0x000001D8A3F30000-0x000001D8A40F2000-memory.dmp

Filesize
1.8MB

Download
memory/1964-3-0x00007FFFE8120000-0x00007FFFE8B0C000-memory.dmp

Filesize
9.9MB

Download
memory/1964-4-0x000001D8A4830000-0x000001D8A4D56000-memory.dmp

Filesize
5.1MB

Download
memory/1964-5-0x00007FFFE8123000-0x00007FFFE8124000-memory.dmp

Filesize
4KB

Download
memory/1964-6-0x00007FFFE8120000-0x00007FFFE8B0C000-memory.dmp

Filesize
9.9MB

Download