Resubmissions
07/11/2024, 06:52
241107-hnee6ayanp1007/11/2024, 06:51
241107-hmnx7sxjaz1007/11/2024, 06:49
241107-hlwawswrhz1007/11/2024, 06:48
241107-hk3ctayaln1007/11/2024, 06:45
241107-hjdcasyajl1005/11/2024, 18:32
241105-w6ncnswcqe10Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/11/2024, 06:52
General
- Target Client/Client-built.exe
- Size 78KB
- Sample241107-hnee6ayanp
- SHA256 bb8a88f17cdb00aeb4c1edf3361b7d835ab7ca1de83c9b08a1b7a34d9197bcdd
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTMwMjYzMjM5NzQ4MDc5MjExNQ.G54kHc.dXC4p2G7m3XikvtpmbIepFkTto52Uc1y1nNfUQ
-
server_id
1302402013232894144
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2336-1-0x00007FFBBD683000-0x00007FFBBD685000-memory.dmp
memory/2336-0-0x000001817C3E0000-0x000001817C3F8000-memory.dmp
memory/2336-2-0x000001817EA90000-0x000001817EC52000-memory.dmp
memory/2336-3-0x00007FFBBD680000-0x00007FFBBE141000-memory.dmp
memory/2336-4-0x000001817F3D0000-0x000001817F8F8000-memory.dmp
memory/2336-5-0x00007FFBBD680000-0x00007FFBBE141000-memory.dmp