Overview

overview

10

Static

static

10

FPS+.exe

windows10-1703-x64

10

Resubmissions

08-09-2024 07:26

240908-h9hdyatclq 10

Analysis

  • max time kernel
    16s
  • max time network
    44s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-09-2024 07:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FPS+.exe

  • Size

    78KB

  • MD5

    b330768ecab3abad7aff662542e47b98

  • SHA1

    9182c254d638fdb07f64819f113af6e3ed34466d

  • SHA256

    6d1703bd786779f40dbb4cfd0de3e39ed7f09afcb8e3555aabc1bf6839ccb4da

  • SHA512

    b62c74545b125dcd6afb4a7923ef52b6b9ac798796e82e7d2229e6748a8728fecbbd197375ebf6e2941451d0ffeb3c1b1d2e33d6d86792b65cb0d1ab75c4949d

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+JPIC:5Zv5PDwbjNrmAE+5IC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI4MjIzOTgwNDU4NjU5NDMxOQ.GEkcj7.DZZa25XaQvgv-ZVRs-HJbbZyRm7z_fvhKTVxyU

  • server_id

    1282239514231701626

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FPS+.exe
    "C:\Users\Admin\AppData\Local\Temp\FPS+.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4092-1-0x00007FFA56F63000-0x00007FFA56F64000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4092-0-0x000001E61E840000-0x000001E61E858000-memory.dmp

    Filesize

    96KB

    Download

  • memory/4092-2-0x000001E638F20000-0x000001E6390E2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/4092-3-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/4092-4-0x000001E639720000-0x000001E639C46000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/4092-5-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

    Filesize

    9.9MB

    Download