Analysis

  • max time kernel
    63s
  • max time network
    64s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 21:52

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    fddc15228128cda4a0f9c08021120ef5

  • SHA1

    48e2c79ed22db8dac4193fc805347921c1fc1b58

  • SHA256

    9fa12cb31372f18bc50dbdcdd6f4762ee70f31e0aaea388982a9d3e690db4c10

  • SHA512

    59e05c1dde0cbb6d0c9851948cb1e3bd22577ba4d516668ce21449537d94844996c839d2e21692537b276d96a13cf626d019117dcc94d9d5fa6fc733f3bed805

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMwOTE3MjAyNzkwMjM5NDQyMg.GIC5i6.qynLbLpEV6yFan9O40eYgKc8Uo5ZcYtNSNfLtA

  • server_id

    1309172409353637929

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1736-0-0x00007FFCC7683000-0x00007FFCC7685000-memory.dmp

    Filesize

    8KB

  • memory/1736-1-0x000002BABFC50000-0x000002BABFC68000-memory.dmp

    Filesize

    96KB

  • memory/1736-2-0x000002BADA1C0000-0x000002BADA382000-memory.dmp

    Filesize

    1.8MB

  • memory/1736-3-0x00007FFCC7680000-0x00007FFCC8141000-memory.dmp

    Filesize

    10.8MB

  • memory/1736-4-0x000002BADA9C0000-0x000002BADAEE8000-memory.dmp

    Filesize

    5.2MB

  • memory/1736-5-0x00007FFCC7683000-0x00007FFCC7685000-memory.dmp

    Filesize

    8KB

  • memory/1736-6-0x00007FFCC7680000-0x00007FFCC8141000-memory.dmp

    Filesize

    10.8MB