Resubmissions
13/07/2024, 12:03
240713-n8hwzasbme1013/07/2024, 12:03
240713-n74r2ssblg1013/07/2024, 02:14
240713-cpdblatdpe1013/07/2024, 02:06
240713-cjs5vs1dkj1013/07/2024, 02:03
240713-cgymkatbne10Analysis
- max time kernel
84s - max time network
59s - platform
windows10-1703_x64 - resource
win10-20240611-en - resource tags
- submitted
13/07/2024, 02:14
General
- Target Client-built.exe
- Size 78KB
- Sample240713-cpdblatdpe
- SHA256 41112af8e2607ffffa2d3251374d36c2acd239e04012f4bd4b86d62b71061886
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
https://discord.com/api/webhooks/1261501911916482582/DWfi1umSb2C2qMgkiBlA3CToo-Okuv-IDp-C5Sr28gd-eBo70-5l1Q0ASNbSY0fxONna
-
server_id
1261501863644368916
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1856-0-0x00007FFA41663000-0x00007FFA41664000-memory.dmp
memory/1856-1-0x0000014C928F0000-0x0000014C92908000-memory.dmp
memory/1856-2-0x0000014CACF80000-0x0000014CAD142000-memory.dmp
memory/1856-3-0x00007FFA41660000-0x00007FFA4204C000-memory.dmp
memory/1856-4-0x0000014CAD780000-0x0000014CADCA6000-memory.dmp
memory/1856-5-0x00007FFA41663000-0x00007FFA41664000-memory.dmp
memory/1856-6-0x00007FFA41660000-0x00007FFA4204C000-memory.dmp