Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 06:33
General
-
Target
Client-built (1).exe
-
Size
78KB
-
MD5
16f49b6c21e3d85f25ac5851a7e0d2d2
-
SHA1
9d6e4b44d9750687c230addc73f64c1d3f81d74e
-
SHA256
d76612e7f69d513d83757b0478c29057120de47e29d720a3432f373c74b99cb0
-
SHA512
b06b206bd622bcb9f10f12559c2a2aa6df2b67fc88d8d85f71aaa7e998e484717a269479cd9bc89003aaeaf9c2021c7b08d08f66c1a0f3085a0f28e16fb04f34
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+aPIC:5Zv5PDwbjNrmAE+GIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI5MzQwMDkwNzI0MDgzMzE1NA.G1OiXJ.GF0yZQN3TiiAaFmH5JEBjN81E8-V2I9GxRZtiE
-
server_id
1293171992937365504
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built (1).exe"C:\Users\Admin\AppData\Local\Temp\Client-built (1).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
2.8MB