Resubmissions
24-11-2024 17:01
241124-vj2q4swkdl 1026-10-2024 14:16
241026-rlatmawdjq 1026-10-2024 14:13
241026-rjt5gsvele 10Analysis
-
max time kernel
54s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-10-2024 13:23
Behavioral task
behavioral1
Sample
Release/Discord rat.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release/Discord rat.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Release/Discord rat.exe
-
Size
79KB
-
MD5
d13905e018eb965ded2e28ba0ab257b5
-
SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858
-
SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
-
SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
-
SSDEEP
1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
Score
10/10
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2736 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2908 2288 Discord rat.exe 28 PID 2288 wrote to memory of 2908 2288 Discord rat.exe 28 PID 2288 wrote to memory of 2908 2288 Discord rat.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2288 -s 5962⤵PID:2908
-
-
C:\Windows\system32\netplwiz.exe"C:\Windows\system32\netplwiz.exe"1⤵PID:2696
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2736