discordrat | 44353669c69e1b2f77c891fdee2c5e935d30e36c18be5b20e44062c66af28e32

Analysis

max time kernel
71s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 08:41

Target

Free Robux.exe
Size

78KB
MD5

041960d257c7b96c4be63450c10a517f
SHA1

be6c8d7390f077b7afd5fe88f781f6ec4407be7d
SHA256

44353669c69e1b2f77c891fdee2c5e935d30e36c18be5b20e44062c66af28e32
SHA512

57a6f47666e6c3f3c7c553211e638643aa2a6f6196ff22c5a0817a9182971701e721919e72ea9a4f281f582c3bd478ff9501f8a9980ce89de018c3141f42a9e4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+iPIC:5Zv5PDwbjNrmAE+OIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4NDQzMjk3MTkwMTgzMzIyNw.GFmNsf.p73rhcMMsLIbgL13MHzRo9scT2hhlm_2Vrbzpc
server_id
1284433394939330651

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of AdjustPrivilegeToken 7 IoCs

C:\Users\Admin\AppData\Local\Temp\Free Robux.exe
"C:\Users\Admin\AppData\Local\Temp\Free Robux.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\Free Robux.exe
"C:\Users\Admin\AppData\Local\Temp\Free Robux.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Users\Admin\AppData\Local\Temp\Free Robux.exe
"C:\Users\Admin\AppData\Local\Temp\Free Robux.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Users\Admin\AppData\Local\Temp\Free Robux.exe
"C:\Users\Admin\AppData\Local\Temp\Free Robux.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Users\Admin\Desktop\Free Robux.exe
"C:\Users\Admin\Desktop\Free Robux.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Users\Admin\Desktop\Free Robux.exe
"C:\Users\Admin\Desktop\Free Robux.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Users\Admin\Desktop\Free Robux.exe
"C:\Users\Admin\Desktop\Free Robux.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3504

memory/1944-0-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

Filesize
8KB

Download
memory/1944-1-0x000001E71F8F0000-0x000001E71F908000-memory.dmp

Filesize
96KB

Download
memory/1944-2-0x000001E739F40000-0x000001E73A102000-memory.dmp

Filesize
1.8MB

Download
memory/1944-3-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1944-4-0x000001E73A740000-0x000001E73AC68000-memory.dmp

Filesize
5.2MB

Download
memory/1944-5-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

Filesize
8KB

Download
memory/1944-6-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-7-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-8-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-9-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-10-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download