Resubmissions
22-07-2024 18:50
240722-xhabkssbmb 1022-07-2024 18:44
240722-xdxlbasdnk 1022-07-2024 18:41
240722-xbzb5a1gjg 1022-07-2024 18:38
240722-xaew4asbll 10Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22-07-2024 18:50
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
5d124e382b6e75350e290f2ca92dcd8f
-
SHA1
1453d068d2d1a5c02696f82c148c91d749c99e68
-
SHA256
0cdf3658260f5e4abb0cc840fb3038d189015d07d9e82f5301a4410fd739e4b9
-
SHA512
41f012b71fa8543fb91a2f30c96defa0d614b917de5b9abed85eb3f11a6643b7c3038574887e399e609f0308b8442a77c07bfae1d442e0810e26a05d5c2c846f
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+4PIC:5Zv5PDwbjNrmAE+cIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI2NTAxMTgwMzUyMDI0MTgyNg.Gixgjj.XDPqCHG2EZuhXeegiOPwvU_Lk4mudkLkpJ6VOU
-
server_id
1265010770744443021
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB