Analysis
- max time kernel
11s - max time network
12s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
23/09/2024, 19:43
General
- Target ArtizSpoofer.exe
- Size 754KB
- Sample240923-yfenyssfld
- SHA256 c286dd7d49f77c6eac8f71f0a05100952267daba14f6822f45fa09e1a0d8689d
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI4NzQ1MjcyODY5OTkxMjIzOA.Gs-HVT.Zxew5iX3Vp5r6QkGj4lVI3c5zxWxLk-pCrIn2U
-
server_id
1287817970042667099
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ArtizSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\ArtizSpoofer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/440-14-0x0000014A2B300000-0x0000014A2B318000-memory.dmp
memory/440-15-0x00007FFD531C3000-0x00007FFD531C5000-memory.dmp
memory/440-16-0x0000014A45970000-0x0000014A45B32000-memory.dmp
memory/440-17-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp
memory/440-18-0x0000014A46170000-0x0000014A46698000-memory.dmp
memory/440-19-0x00007FFD531C3000-0x00007FFD531C5000-memory.dmp
memory/440-20-0x00007FFD531C0000-0x00007FFD53C81000-memory.dmp