Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
15-07-2024 19:45
General
-
Target
executor.exe
-
Size
78KB
-
MD5
e1494c0e764cba65e9f4587d66fe0aa7
-
SHA1
9b4d1e845f50f401743848a4482c7612833aa679
-
SHA256
a5eb869393a0ec941ae9bb25f817004cf668ed4cb563189af9b4e976acc91d8a
-
SHA512
129aadf5d7df8835d82fa73b039de621798ab2d34ade3983ea7745555fc56c3ed4a01f03767804f000d73ea1c87a82fa4224794fbb554d5d31d403ffb3f77465
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NjYyNDkzOTk3MzQ4MDYzOA.GT32M_.lhjiOtBbZnAqoOopUAFURemzfI_gNk6usA4kPk
-
server_id
1258096867728818177
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\executor.exe"C:\Users\Admin\AppData\Local\Temp\executor.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/408-0-0x0000021105640000-0x0000021105658000-memory.dmpFilesize
96KB
-
memory/408-1-0x00007FFAA4D43000-0x00007FFAA4D44000-memory.dmpFilesize
4KB
-
memory/408-2-0x000002111FCA0000-0x000002111FE62000-memory.dmpFilesize
1.8MB
-
memory/408-3-0x00007FFAA4D40000-0x00007FFAA572C000-memory.dmpFilesize
9.9MB
-
memory/408-4-0x00000211205A0000-0x0000021120AC6000-memory.dmpFilesize
5.1MB
-
memory/408-6-0x00007FFAA4D40000-0x00007FFAA572C000-memory.dmpFilesize
9.9MB