Resubmissions
13/07/2024, 12:03
240713-n8hwzasbme1013/07/2024, 12:03
240713-n74r2ssblg1013/07/2024, 02:14
240713-cpdblatdpe1013/07/2024, 02:06
240713-cjs5vs1dkj1013/07/2024, 02:03
240713-cgymkatbne10Analysis
- max time kernel
105s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20240709-uk - resource tags
- submitted
13/07/2024, 12:03
General
- Target Client-built.exe
- Size 78KB
- Sample240713-n8hwzasbme
- SHA256 41112af8e2607ffffa2d3251374d36c2acd239e04012f4bd4b86d62b71061886
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
https://discord.com/api/webhooks/1261501911916482582/DWfi1umSb2C2qMgkiBlA3CToo-Okuv-IDp-C5Sr28gd-eBo70-5l1Q0ASNbSY0fxONna
-
server_id
1261501863644368916
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4492-0-0x00007FFE609F3000-0x00007FFE609F5000-memory.dmp
memory/4492-1-0x000002C62C440000-0x000002C62C458000-memory.dmp
memory/4492-2-0x000002C646A70000-0x000002C646C32000-memory.dmp
memory/4492-3-0x00007FFE609F0000-0x00007FFE614B1000-memory.dmp
memory/4492-4-0x000002C647270000-0x000002C647798000-memory.dmp
memory/4492-5-0x00007FFE609F3000-0x00007FFE609F5000-memory.dmp
memory/4492-6-0x00007FFE609F0000-0x00007FFE614B1000-memory.dmp