Resubmissions
26-12-2024 02:51
241226-dcejkavnex 10Analysis
-
max time kernel
301s -
max time network
900s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 02:51
General
-
Target
fixedbotnet.exe
-
Size
78KB
-
MD5
4dcaad8aaf5a96198f7a6e7ed8e370e9
-
SHA1
2c0637216a17bcf87636e8a1968e371b7e90ba6f
-
SHA256
0917c5da516020e72dc27b1c731723fd3ec6667b4f0c4ef2755e1c39b7f2b626
-
SHA512
a9e381f3d21f9db22286e9e3e8a8b7af1ffd6967a44be00e8226d1eefa52d420bbf5fd2b0fe17ca8f43acb2001019d4942b8c026c17471a7463b58cd51679654
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+UPIC:5Zv5PDwbjNrmAE+IIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMxOTgzODgzNzk3MDgyOTM1Mw.G15bFE.buKTPu-i9rZJyohew9QrmkA3ja15UUEJ2GTDqQ
-
server_id
1303174293991063612
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fixedbotnet.exe"C:\Users\Admin\AppData\Local\Temp\fixedbotnet.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB