Analysis
- max time kernel
94s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
15/07/2024, 18:45
General
- Target antongpj.exe
- Size 452KB
- Sample240715-xd3sbstglm
- SHA256 09f62ca9ce707a10e1cc29c4e857ae8e38defa05d0f8cc0cad4f84022d6c5b4b
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI2MjQ3NTk0MjgzMjM3Mzc4MA.Gm3A78.SvvnKqIpnEdUSKBmPvoekRlb-Nq9n0i0njcYUY
-
server_id
1262476292713087037
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\antongpj.exe"C:\Users\Admin\AppData\Local\Temp\antongpj.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/3728-16-0x000001B0C7F10000-0x000001B0C7F28000-memory.dmp
memory/3728-18-0x000001B0E2580000-0x000001B0E2742000-memory.dmp
memory/3728-17-0x00007FFAAD900000-0x00007FFAADBC9000-memory.dmp
memory/3728-19-0x00007FFAAD900000-0x00007FFAADBC9000-memory.dmp
memory/3728-20-0x000001B0E2D80000-0x000001B0E32A8000-memory.dmp
memory/3728-21-0x00007FFAAD900000-0x00007FFAADBC9000-memory.dmp