Analysis
- max time kernel
125s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
24/09/2024, 02:55
General
- Target ArtizSpoofer.exe
- Size 754KB
- Sample240924-dektcswfrd
- SHA256 c286dd7d49f77c6eac8f71f0a05100952267daba14f6822f45fa09e1a0d8689d
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI4NzQ1MjcyODY5OTkxMjIzOA.Gs-HVT.Zxew5iX3Vp5r6QkGj4lVI3c5zxWxLk-pCrIn2U
-
server_id
1287817970042667099
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ArtizSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\ArtizSpoofer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4928,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/3936-14-0x00007FFD01A53000-0x00007FFD01A55000-memory.dmp
memory/3936-15-0x00000277D02B0000-0x00000277D02C8000-memory.dmp
memory/3936-16-0x00000277EA8D0000-0x00000277EAA92000-memory.dmp
memory/3936-17-0x00007FFD01A50000-0x00007FFD02511000-memory.dmp
memory/3936-18-0x00000277EB0D0000-0x00000277EB5F8000-memory.dmp
memory/3936-19-0x00007FFD01A53000-0x00007FFD01A55000-memory.dmp
memory/3936-20-0x00007FFD01A50000-0x00007FFD02511000-memory.dmp