Resubmissions
26/01/2025, 06:17
250126-g134lswjbr1026/01/2025, 00:44
250126-a3vrpawkay1025/01/2025, 07:43
250125-jkl69ssqat1025/01/2025, 06:18
250125-g2zsks1nck1007/11/2024, 17:59
241107-wksehawmb11007/11/2024, 17:59
241107-wksehawmbz06/11/2024, 11:31
241106-nm7m7szapg1005/11/2024, 22:04
241105-1y6aqsynhv1005/11/2024, 21:53
241105-1rm6ksyhqe1004/11/2024, 20:03
241104-ysp1fsvrfz10Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/11/2024, 17:27
General
- Target ImageLogger-cleaned.exe
- Size 78KB
- Sample241104-v1eb5stjct
- SHA256 6a88e4cd73a6a4b7768b1df63aa7ff54d911568d3cd62d88c4b447cec1cb1ff2
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI5NzUzOTkxNjAxNTg2NTkwNw.Gfdmm0.1DHqcqM266sEW3k8XieYxIORIkysBrFHb6r-3Q
-
server_id
1297365710649036921
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4752-0-0x00007FF847423000-0x00007FF847425000-memory.dmp
memory/4752-1-0x0000012ECB4B0000-0x0000012ECB4C8000-memory.dmp
memory/4752-2-0x0000012EE5AB0000-0x0000012EE5C72000-memory.dmp
memory/4752-3-0x00007FF847420000-0x00007FF847EE1000-memory.dmp
memory/4752-4-0x0000012EE62F0000-0x0000012EE6818000-memory.dmp
memory/4752-5-0x00007FF847423000-0x00007FF847425000-memory.dmp
memory/4752-6-0x00007FF847420000-0x00007FF847EE1000-memory.dmp