Analysis
- max time kernel
35s - max time network
45s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
- submitted
19/09/2024, 14:19
General
- Target SStlr.exe
- Size 78KB
- Sample240919-rm9dkssfrb
- SHA256 e0d5cedfc19c63b1015d0681295235eea136d0655219943557019b18effb8987
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI4NjA4MjY0OTUyOTUxNjA2NA.Gcx-AZ.UfnCLixPx9n_RbsOFtBOxB5V9Q_ek3rSRCt2S0
-
server_id
1285374325309968404
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SStlr.exe"C:\Users\Admin\AppData\Local\Temp\SStlr.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/884-0-0x00007FF8B2A53000-0x00007FF8B2A55000-memory.dmp
memory/884-1-0x0000019C060B0000-0x0000019C060C8000-memory.dmp
memory/884-2-0x0000019C20760000-0x0000019C20922000-memory.dmp
memory/884-3-0x00007FF8B2A50000-0x00007FF8B3511000-memory.dmp
memory/884-4-0x0000019C210A0000-0x0000019C215C8000-memory.dmp
memory/884-5-0x00007FF8B2A53000-0x00007FF8B2A55000-memory.dmp
memory/884-6-0x00007FF8B2A50000-0x00007FF8B3511000-memory.dmp