Resubmissions
07-11-2024 06:52
241107-hnee6ayanp 1007-11-2024 06:51
241107-hmnx7sxjaz 1007-11-2024 06:49
241107-hlwawswrhz 1007-11-2024 06:48
241107-hk3ctayaln 1007-11-2024 06:45
241107-hjdcasyajl 1005-11-2024 18:32
241105-w6ncnswcqe 10Analysis
-
max time kernel
23s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 06:52
Behavioral task
behavioral1
Sample
Client/Client-built.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client/Client-built.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Client/Client-built.exe
-
Size
78KB
-
MD5
7e60d19b97042f52c18c1d924aec839f
-
SHA1
44fa1257c07125d6f2300145cde7e112db18d8e6
-
SHA256
bb8a88f17cdb00aeb4c1edf3361b7d835ab7ca1de83c9b08a1b7a34d9197bcdd
-
SHA512
09c1fabef784040dbc87b49994294ee104f72bdfdbdb705bbea0c21bddff376edfb7bb4195af148a00d6342e7c4703a585b085bcb4aaa6e8939d2728947e5123
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+obPIC:5Zv5PDwbjNrmAE+oTIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMwMjYzMjM5NzQ4MDc5MjExNQ.G54kHc.dXC4p2G7m3XikvtpmbIepFkTto52Uc1y1nNfUQ
-
server_id
1302402013232894144
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1788 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1788 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe 1788 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1244 2544 Client-built.exe 30 PID 2544 wrote to memory of 1244 2544 Client-built.exe 30 PID 2544 wrote to memory of 1244 2544 Client-built.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client\Client-built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2544 -s 5962⤵PID:1244
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1788