Overview

overview

10

Static

static

10

Client-built.exe

windows10-1703-x64

10

Client-built.exe

windows11-21h2-x64

10

Resubmissions

13-07-2024 12:03

240713-n8hwzasbme 10

13-07-2024 12:03

240713-n74r2ssblg 10

13-07-2024 02:14

240713-cpdblatdpe 10

13-07-2024 02:06

240713-cjs5vs1dkj 10

13-07-2024 02:03

240713-cgymkatbne 10

Analysis

  • max time kernel
    84s
  • max time network
    59s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13-07-2024 02:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    7acb83ea4e34507f021eb6d6141a8c9e

  • SHA1

    058ae3035af017e16a1eeae3ca46b4e912420fb8

  • SHA256

    41112af8e2607ffffa2d3251374d36c2acd239e04012f4bd4b86d62b71061886

  • SHA512

    0b71cd12ac99eaa6d97a10386190355852227444c3765ced1bd3e50eeef8ab1c1319911cbf5a954aba1750154fc6356de6be8a9afd72b2b489424de7a8010196

  • SSDEEP

    1536:K2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+3PIC:KZb5PDwbjNrmAE+/IC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    https://discord.com/api/webhooks/1261501911916482582/DWfi1umSb2C2qMgkiBlA3CToo-Okuv-IDp-C5Sr28gd-eBo70-5l1Q0ASNbSY0fxONna

  • server_id

    1261501863644368916

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1856-0-0x00007FFA41663000-0x00007FFA41664000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1856-1-0x0000014C928F0000-0x0000014C92908000-memory.dmp

    Filesize

    96KB

    Download

  • memory/1856-2-0x0000014CACF80000-0x0000014CAD142000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/1856-3-0x00007FFA41660000-0x00007FFA4204C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1856-4-0x0000014CAD780000-0x0000014CADCA6000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1856-5-0x00007FFA41663000-0x00007FFA41664000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1856-6-0x00007FFA41660000-0x00007FFA4204C000-memory.dmp

    Filesize

    9.9MB

    Download