Analysis
-
max time kernel
93s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08-07-2024 08:52
General
-
Target
Client-built.exe
-
Size
89KB
-
MD5
ef6d019f15f74d6ad839a9ba75318981
-
SHA1
1ebbe171a6cad7d3d2327987b465e6c956b7b439
-
SHA256
b951272f47ced0c14aa6be5372daa3e89fff7b44dc5ae253c8166aeffe667a15
-
SHA512
6078520ff4ea91b971421f4f434726b6f626d407d9dbc388bc830ee5defb14e3b40432b7ad248472a146567679ff43443250965d5f84777aa9b342cb93fac5c9
-
SSDEEP
1536:nE+2kB+5mjlB7OJ7nyfqgjOXT3UhqWkIod+K46MUL2UgbmNrt+fexCxoKV6+fcGH:Ed55mjDOJmfqgjOD3UhqpI4T4oLtgbm
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NTcyNzcxMzM5ODgyMDg2NQ.GY_3hS.g7WGHrqjV92f8bpx1SBQS0hKECEsHYsCTP5ByY
-
server_id
1255727160723767347
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2232-1-0x00007FF9592E3000-0x00007FF9592E5000-memory.dmpFilesize
8KB
-
memory/2232-0-0x000002D006310000-0x000002D00632A000-memory.dmpFilesize
104KB
-
memory/2232-2-0x000002D0208C0000-0x000002D020A82000-memory.dmpFilesize
1.8MB
-
memory/2232-3-0x00007FF9592E0000-0x00007FF959DA1000-memory.dmpFilesize
10.8MB
-
memory/2232-4-0x000002D0210C0000-0x000002D0215E8000-memory.dmpFilesize
5.2MB
-
memory/2232-5-0x00007FF9592E3000-0x00007FF9592E5000-memory.dmpFilesize
8KB
-
memory/2232-6-0x00007FF9592E0000-0x00007FF959DA1000-memory.dmpFilesize
10.8MB