Resubmissions

07-12-2024 15:42

241207-s5pmka1qcj 10

07-12-2024 03:12

241207-dp8yyasqgy 10

Analysis

  • max time kernel
    91s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2024 15:42

General

  • Target

    b3bf1cabe7e98e7120e69d3d5c63cea55dd9345aa9facae7a97a84134eaf1984.exe

  • Size

    78KB

  • MD5

    047501531983682c470ca7560077477a

  • SHA1

    99d90e9b66320b9c08e9633607f15743f7d4af7c

  • SHA256

    b3bf1cabe7e98e7120e69d3d5c63cea55dd9345aa9facae7a97a84134eaf1984

  • SHA512

    47e76b0d14c5d2f601b087413bfa9ba6a00ea11a9ec6666e4787c926b0a2df92da313ed4fe6736913d623de21683ea876006eb43d75a10cd5902be6a2b662bab

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+JPIC:5Zv5PDwbjNrmAE+5IC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMxMjYwNjY0NDYwOTM1NTg2Nw.GmiBbD.BxOkmi6_jSm3KiEBfaoI7z9GP_TE4zxloC3fjo

  • server_id

    1312606556201681018

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3bf1cabe7e98e7120e69d3d5c63cea55dd9345aa9facae7a97a84134eaf1984.exe
    "C:\Users\Admin\AppData\Local\Temp\b3bf1cabe7e98e7120e69d3d5c63cea55dd9345aa9facae7a97a84134eaf1984.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:416
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:396

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/416-0-0x00007FFE4CDD3000-0x00007FFE4CDD5000-memory.dmp

      Filesize

      8KB

    • memory/416-1-0x0000015C4AF70000-0x0000015C4AF88000-memory.dmp

      Filesize

      96KB

    • memory/416-2-0x0000015C65570000-0x0000015C65732000-memory.dmp

      Filesize

      1.8MB

    • memory/416-3-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

      Filesize

      10.8MB

    • memory/416-4-0x0000015C65D70000-0x0000015C66298000-memory.dmp

      Filesize

      5.2MB

    • memory/416-5-0x00007FFE4CDD3000-0x00007FFE4CDD5000-memory.dmp

      Filesize

      8KB

    • memory/416-6-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

      Filesize

      10.8MB