Analysis

  • max time kernel
    95s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-09-2024 13:25

General

  • Target

    solaraV8.exe

  • Size

    78KB

  • MD5

    4dbaa7f4cab6e1c9053ec5a30d057a63

  • SHA1

    84dee1923f3d65f106d6b6b41e2a90895d444c99

  • SHA256

    fc2efd8bc73e8194e6ffd0b08e2a07d5436678ec8fa117376454e12e7d5a7ecc

  • SHA512

    454b4742f8267984dd801ab254f0b13e170de250b95ec0cf80095b8ac56fa627c4b9d34c60cd5215797fd6afd4e65265dc676e94ad4858333df1aad1165c3ca2

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+JPIC:5Zv5PDwbjNrmAE+5IC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI4MzQ3NTY3MzkxODM0NTIyOA.GwQZAy.dzNxoLSQrrHQ7kQ84QzgXcXwQVIiFgky0-vXwk

  • server_id

    1037097190742560768

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\solaraV8.exe
    "C:\Users\Admin\AppData\Local\Temp\solaraV8.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4172-0-0x00007FFF2CB43000-0x00007FFF2CB45000-memory.dmp

    Filesize

    8KB

  • memory/4172-1-0x0000017469510000-0x0000017469528000-memory.dmp

    Filesize

    96KB

  • memory/4172-2-0x000001746BBD0000-0x000001746BD92000-memory.dmp

    Filesize

    1.8MB

  • memory/4172-3-0x00007FFF2CB40000-0x00007FFF2D601000-memory.dmp

    Filesize

    10.8MB

  • memory/4172-4-0x000001746C3D0000-0x000001746C8F8000-memory.dmp

    Filesize

    5.2MB

  • memory/4172-5-0x00007FFF2CB40000-0x00007FFF2D601000-memory.dmp

    Filesize

    10.8MB