Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2024, 23:01

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    83759f388628e29fc938c08ad73ca8e8

  • SHA1

    b0034015a739c47475eb604825a5965b46202b2f

  • SHA256

    59dd036a154e0b5305a8922b0b7587c6003039769c69fd1c2823b10d2f870d15

  • SHA512

    4b058e4bdbae0e34d07592f7c9ec00c24031409d10c6aee7d939ef53b6effd0c7ca45cc24a7f89ee3747acd18fa557ba24d3167e6f69dde70671555dca581b1f

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+NPIC:5Zv5PDwbjNrmAE+dIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMxNjkwMTUxNDM4Nzc4Mzc1Mg.GDjimL.Gmm9CbGt0FXgwCeFMXwZE1fdp920iDz_238Xz0

  • server_id

    1316900059966607414

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1312-0-0x000002657DA00000-0x000002657DA18000-memory.dmp

    Filesize

    96KB

  • memory/1312-1-0x00007FF95A713000-0x00007FF95A715000-memory.dmp

    Filesize

    8KB

  • memory/1312-2-0x0000026580070000-0x0000026580232000-memory.dmp

    Filesize

    1.8MB

  • memory/1312-3-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

    Filesize

    10.8MB

  • memory/1312-4-0x00000265187E0000-0x0000026518D08000-memory.dmp

    Filesize

    5.2MB

  • memory/1312-5-0x00007FF95A710000-0x00007FF95B1D1000-memory.dmp

    Filesize

    10.8MB