Analysis
- max time kernel
94s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
17/12/2024, 15:14
General
- Target Client-built.exe
- Size 78KB
- Sample241217-smdscaskfz
- SHA256 53ee073957c0d72b18fb224b375d96f433809ec52ce026a175e455730f1c5196
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTMxNjc4NDY0ODg4MTE4MDc1Mg.G7o_Zc.sbube1oVRorBeqBxFOOn46MICGZ-pqN_5IhxnM
-
server_id
1316784990255583242
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1520-0-0x00007FFC7BC93000-0x00007FFC7BC95000-memory.dmp
memory/1520-1-0x000002312FDB0000-0x000002312FDC8000-memory.dmp
memory/1520-2-0x000002314A350000-0x000002314A512000-memory.dmp
memory/1520-3-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp
memory/1520-4-0x000002314AB50000-0x000002314B078000-memory.dmp
memory/1520-5-0x00007FFC7BC93000-0x00007FFC7BC95000-memory.dmp
memory/1520-6-0x00007FFC7BC90000-0x00007FFC7C751000-memory.dmp