Analysis
- max time kernel
147s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
09/09/2024, 22:18
General
- Target Client-built.exe
- Size 78KB
- Sample240909-18aa2stamj
- SHA256 b39337904af234ce5ab04051a009b9a8c60fa46bccc76d449800be886c123e0b
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI4MjgyNzA4MTIyMjE5NzI1OA.GYGKGD._ZCToapQCVB6uJoewAZmBanGCE2C92HCs5RwD0
-
server_id
1282683459751510098
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SearchHoverUnifiedTileModelCache.dat
SearchHoverUnifiedTileModelCache.dat
memory/3420-0-0x00007FFD38193000-0x00007FFD38195000-memory.dmp
memory/3420-1-0x00000232320D0000-0x00000232320E8000-memory.dmp
memory/3420-2-0x000002324C750000-0x000002324C912000-memory.dmp
memory/3420-3-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp
memory/3420-4-0x000002324D9D0000-0x000002324DEF8000-memory.dmp
memory/3420-5-0x00007FFD38193000-0x00007FFD38195000-memory.dmp
memory/3420-6-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp