Analysis

  • max time kernel
    17s
  • max time network
    23s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06-10-2024 13:04

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    08a5f1b89e6944163b9ec83d08b55d7e

  • SHA1

    1741611da7edf548b0b75714d43eb9d3548e14df

  • SHA256

    9bc8769d0dd47237653ef3320afb136df186dc6c0782f86ab1c3d2af20b9202e

  • SHA512

    b7b5beabc56bb674af46633125ea558c6f440cb94dc59ce440345193fa37076c26633996ceba9f7db0cf7a81f93928003934ea798338890570585dab088e4dc7

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI5MjQ3MDY0NTIyOTA5NzAwMA.GNERIx.GW0rdAd6D_xAs0J8UsqQVnTwz9YQuxERLzA87s

  • server_id

    1292471074809839676

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3060 -s 600
      2⤵
        PID:1980
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2796
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x5e0
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2900

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3060-0-0x000007FEF6363000-0x000007FEF6364000-memory.dmp

        Filesize

        4KB

      • memory/3060-1-0x000000013FB10000-0x000000013FB28000-memory.dmp

        Filesize

        96KB

      • memory/3060-2-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

        Filesize

        9.9MB

      • memory/3060-3-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

        Filesize

        9.9MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.