Analysis
- max time kernel
93s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/09/2024, 03:22
General
- Target SStlr.exe
- Size 78KB
- Sample240920-dw8lrawbqe
- SHA256 e0d5cedfc19c63b1015d0681295235eea136d0655219943557019b18effb8987
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI4NjA4MjY0OTUyOTUxNjA2NA.Gcx-AZ.UfnCLixPx9n_RbsOFtBOxB5V9Q_ek3rSRCt2S0
-
server_id
1285374325309968404
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SStlr.exe"C:\Users\Admin\AppData\Local\Temp\SStlr.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1460-0-0x00007FFCC8C53000-0x00007FFCC8C55000-memory.dmp
memory/1460-1-0x000001A7F08B0000-0x000001A7F08C8000-memory.dmp
memory/1460-2-0x000001A7F2E40000-0x000001A7F3002000-memory.dmp
memory/1460-3-0x00007FFCC8C50000-0x00007FFCC9711000-memory.dmp
memory/1460-4-0x000001A7F3640000-0x000001A7F3B68000-memory.dmp
memory/1460-5-0x00007FFCC8C50000-0x00007FFCC9711000-memory.dmp