Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Resubmissions

13-07-2024 12:03

240713-n8hwzasbme 10

13-07-2024 12:03

240713-n74r2ssblg 10

13-07-2024 02:14

240713-cpdblatdpe 10

13-07-2024 02:06

240713-cjs5vs1dkj 10

13-07-2024 02:03

240713-cgymkatbne 10

Analysis

  • max time kernel
    105s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-uk
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-uklocale:uk-uaos:windows10-2004-x64systemwindows
  • submitted
    13-07-2024 12:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    7acb83ea4e34507f021eb6d6141a8c9e

  • SHA1

    058ae3035af017e16a1eeae3ca46b4e912420fb8

  • SHA256

    41112af8e2607ffffa2d3251374d36c2acd239e04012f4bd4b86d62b71061886

  • SHA512

    0b71cd12ac99eaa6d97a10386190355852227444c3765ced1bd3e50eeef8ab1c1319911cbf5a954aba1750154fc6356de6be8a9afd72b2b489424de7a8010196

  • SSDEEP

    1536:K2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+3PIC:KZb5PDwbjNrmAE+/IC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    https://discord.com/api/webhooks/1261501911916482582/DWfi1umSb2C2qMgkiBlA3CToo-Okuv-IDp-C5Sr28gd-eBo70-5l1Q0ASNbSY0fxONna

  • server_id

    1261501863644368916

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4492-0-0x00007FFE609F3000-0x00007FFE609F5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4492-1-0x000002C62C440000-0x000002C62C458000-memory.dmp

    Filesize

    96KB

    Download

  • memory/4492-2-0x000002C646A70000-0x000002C646C32000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/4492-3-0x00007FFE609F0000-0x00007FFE614B1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4492-4-0x000002C647270000-0x000002C647798000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/4492-5-0x00007FFE609F3000-0x00007FFE609F5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4492-6-0x00007FFE609F0000-0x00007FFE614B1000-memory.dmp

    Filesize

    10.8MB

    Download