Analysis
-
max time kernel
191s -
max time network
194s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
08-07-2024 18:25
Errors
Reason
Machine shutdown
General
-
Target
Test.exe
-
Size
78KB
-
MD5
bbbb9f0fb811b0428806262bda7deae4
-
SHA1
f6ca297ca8b2d3aa499a9e24a51de252f7f35276
-
SHA256
854d608165b291d469b2512be40803242d9379ef58087da9096f3ee93da37920
-
SHA512
bba651156550bc001f41156766d80046aa6e5dd755c9af2e037c81922175c61513a2c94081c9942a1d749c9c712ac7f24ff86be181962874f684e1b19bfba2b2
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0NzY0ODI3NjkwNDI4NDIxMQ.GzYU-o.gTVjR5kc0qgiHq8KPJLw_Xg1mnEgJyOsa1wDxU
-
server_id
1247801636122787851
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Test.exe"C:\Users\Admin\AppData\Local\Temp\Test.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB