Overview

overview

10

Static

static

10

ab4714df18...48.exe

windows7-x64

10

ab4714df18...48.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 01:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ab4714df1877b59e511db33d45e27748.exe

  • Size

    78KB

  • MD5

    ab4714df1877b59e511db33d45e27748

  • SHA1

    9361f003225e8d9e6318d21a0ea4c3e8abd28098

  • SHA256

    c294635103f902bcc9efe1b4ae4ef86b226a657b627fca38e0db840f882dd0a5

  • SHA512

    ed18a6e4fa0d430068c7010f82cd315db61a59a1124b73485d605a7ba06a28272a9e75c00455cddfa134fe0877fd913bf708e58514ca96be92235cb8bad8ea04

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI1NzYzNjQ1NDI5MzcwNDcwNA.GriHoe.5AoWc0NGUyx_i3CgIfNmTychDUDT5RP-vDj-7Q

  • server_id

    1214291005298315345

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab4714df1877b59e511db33d45e27748.exe
    "C:\Users\Admin\AppData\Local\Temp\ab4714df1877b59e511db33d45e27748.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1412-1-0x00007FFA41813000-0x00007FFA41815000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1412-0-0x0000027B90910000-0x0000027B90928000-memory.dmp
    Filesize

    96KB

    Download
  • memory/1412-2-0x0000027BAB0E0000-0x0000027BAB2A2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/1412-3-0x00007FFA41810000-0x00007FFA422D1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/1412-4-0x0000027BAB7E0000-0x0000027BABD08000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/1412-5-0x00007FFA41810000-0x00007FFA422D1000-memory.dmp
    Filesize

    10.8MB

    Download