Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
15/12/2024, 12:31
General
- Target SperexUpdatev3.exe
- Size 78KB
- Sample241215-pp388stpgv
- SHA256 15c9db25ecf6db656246d23fd23cdcd328fbc7d59e4c13ef0aecb774674355ae
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTMxNzUyOTIxNDUyNTkwMjg4OA.G2AU-9.gp8oui8FZgS9lfAB_I_udCmnKXuah-v_04_U84
-
server_id
1317529702952337458
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SperexUpdatev3.exe"C:\Users\Admin\AppData\Local\Temp\SperexUpdatev3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2976-1-0x000001E4CC020000-0x000001E4CC038000-memory.dmp
memory/2976-0-0x00007FF8BCD33000-0x00007FF8BCD35000-memory.dmp
memory/2976-2-0x000001E4E66B0000-0x000001E4E6872000-memory.dmp
memory/2976-3-0x00007FF8BCD30000-0x00007FF8BD7F1000-memory.dmp
memory/2976-4-0x000001E4E6EB0000-0x000001E4E73D8000-memory.dmp
memory/2976-5-0x00007FF8BCD30000-0x00007FF8BD7F1000-memory.dmp