discordrat | 954bf7c432eac4d4291b76b598fe25f28275800eb9d06fe7f3f0b53b41f72c74

Analysis

max time kernel
16s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 15:41

Target

main.exe
Size

78KB
MD5

2dfd2fba1022292bcd1867b126624260
SHA1

ef374c3639e3f28a8594e1385a0f45a8e51f2673
SHA256

954bf7c432eac4d4291b76b598fe25f28275800eb9d06fe7f3f0b53b41f72c74
SHA512

1cd7427295950491b627945c4f848906e3ee710e593033ed24638b7e29ace004b7ae8d3cfc7726b3e1dea53595336ba165b1fd5282f8637b047a50217238c9fc
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+GnPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI2MDQwNzQ1MjQyODUzMzgzMQ.GYv6Cs.bHorOgR3dzpv33F18dZaRpWKB43NnKIjozVcS8
server_id
1260407315073597510

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

main.exe

description pid process

Token: SeDebugPrivilege 3888 main.exe

description	pid	process
Token: SeDebugPrivilege	3888	main.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3888

memory/3888-0-0x000001F0723A0000-0x000001F0723B8000-memory.dmp

Filesize
96KB

Download
memory/3888-1-0x00007FF8B5743000-0x00007FF8B5745000-memory.dmp

Filesize
8KB

Download
memory/3888-2-0x000001F0749A0000-0x000001F074B62000-memory.dmp

Filesize
1.8MB

Download
memory/3888-3-0x00007FF8B5740000-0x00007FF8B6201000-memory.dmp

Filesize
10.8MB

Download
memory/3888-4-0x000001F0751A0000-0x000001F0756C8000-memory.dmp

Filesize
5.2MB

Download