Analysis
-
max time kernel
58s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 18:19
Errors
Reason
Machine shutdown
General
-
Target
Discord rat.exe
-
Size
98KB
-
MD5
d069aee7c616e0a7a15fa4e7daa39df4
-
SHA1
6377089eadaf83365d9890e5af6175123119fcc6
-
SHA256
8948cc84af114230b00b119e2354563e68b5edb57f065ffef5d30a12aaf2d4e0
-
SHA512
0f25976cdf77e7b802807e98453a4b78ae4699b7109cffdf7539166de091a9d0f2bf178b63aebdc916d46bac8a7b175cd40101f88b1d504e103c982782215bc1
-
SSDEEP
3072:XxAAGnqL98A4jF+ishms3ydbJDPrt+zNM:BEHshms3ydblr
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
TVRNeE5ESTROVEkzTmpBek56WTBOREk0T0EuR0ZFQjRhLjg0elpVVTJPQ1EzYnNBTGVuSVl5QjdNQ1NtVjZGSzVRVTM3NTYw
-
server_id
1316471819527524362
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB