Resubmissions
23-07-2024 14:26
240723-rscxkaxflf 1023-07-2024 14:20
240723-rnv8cavbjk 1023-07-2024 14:13
240723-rjwnbathkm 10Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 14:20
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
5ccc8cb73a3e7f49f02309b8234150f7
-
SHA1
2e25a1e3c2dea17b8a55794ea410efc20a20ba89
-
SHA256
96b5be62a3f1c6550f243ce18051af2f6e105cb8e5869d1b685df3e6e382e4ca
-
SHA512
f5aad017d92ad6611aea1c9751e57a4847de36c8e0e40b461b01d3053b30fb563e6258993836f1d193393b95feee6da440352d073d2e1111c2b96186afaafe31
-
SSDEEP
1536:Z2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+fBPIC:ZZv5PDwbjNrmAE+fRIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI2NTI5NDU0NzA5MzU1MzIwMw.G4XHgH.w73SKG9eGEqZjt7cDrIl25uvvZMMECf3wWXHYA
-
server_id
1265294099100205107
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2796 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2796 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2260 2948 Client-built.exe 30 PID 2948 wrote to memory of 2260 2948 Client-built.exe 30 PID 2948 wrote to memory of 2260 2948 Client-built.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2948 -s 6002⤵PID:2260
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2796