Resubmissions
15/08/2024, 00:20
240815-am97fatfrb1006/08/2024, 18:41
240806-xbqpzszhja05/08/2024, 23:15
240805-281cxavhph1005/08/2024, 23:13
240805-27gjeavhmc10Analysis
- max time kernel
94s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
05/08/2024, 23:15
General
- Target Cute cat pic.exe
- Size 630KB
- Sample240805-281cxavhph
- SHA256 85ad2e6790b045addec97dd7ac9d54e3e3995a259c7485f071041708ce57aadf
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI3MDE1MTU0NDQyNzM4NDk2Mw.GgJHGv.V9KbKHSvwp2eqesQyx1XSS-pmcnaA8qOU-5WRw
-
server_id
1270152842300100618
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cute cat pic.exe"C:\Users\Admin\AppData\Local\Temp\Cute cat pic.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/4684-14-0x000001DD6D610000-0x000001DD6D628000-memory.dmp
memory/4684-15-0x00007FFAEF173000-0x00007FFAEF175000-memory.dmp
memory/4684-16-0x000001DD6FC70000-0x000001DD6FE32000-memory.dmp
memory/4684-17-0x00007FFAEF170000-0x00007FFAEFC31000-memory.dmp
memory/4684-18-0x000001DD704B0000-0x000001DD709D8000-memory.dmp
memory/4684-19-0x00007FFAEF170000-0x00007FFAEFC31000-memory.dmp