Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
15/07/2024, 19:38
General
- Target executor.exe
- Size 78KB
- Sample240715-ycsreawcln
- SHA256 a5eb869393a0ec941ae9bb25f817004cf668ed4cb563189af9b4e976acc91d8a
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI1NjYyNDkzOTk3MzQ4MDYzOA.GT32M_.lhjiOtBbZnAqoOopUAFURemzfI_gNk6usA4kPk
-
server_id
1258096867728818177
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\executor.exe"C:\Users\Admin\AppData\Local\Temp\executor.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3132-0-0x00007FFB657A3000-0x00007FFB657A5000-memory.dmp
memory/3132-1-0x000001C41E950000-0x000001C41E968000-memory.dmp
memory/3132-2-0x000001C439110000-0x000001C4392D2000-memory.dmp
memory/3132-3-0x00007FFB657A0000-0x00007FFB66261000-memory.dmp
memory/3132-4-0x000001C439910000-0x000001C439E38000-memory.dmp
memory/3132-5-0x00007FFB657A3000-0x00007FFB657A5000-memory.dmp
memory/3132-6-0x00007FFB657A0000-0x00007FFB66261000-memory.dmp