Analysis
- max time kernel
94s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
26/12/2024, 11:12
General
- Target e5b17b3141c14d41664d0ff5b04d65f6a4688ba092477c156d47b0e99ddfb586.exe
- Size 78KB
- Sample241226-nbbfmatpfz
- SHA256 e5b17b3141c14d41664d0ff5b04d65f6a4688ba092477c156d47b0e99ddfb586
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTIyNDc1OTk0MjMxODEyOTIzMw.Gz9uGb.wx8CPvYFOhJ1PZtR5rQeXTQjzkEGdhAAgN10rc
-
server_id
977774990676095038
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5b17b3141c14d41664d0ff5b04d65f6a4688ba092477c156d47b0e99ddfb586.exe"C:\Users\Admin\AppData\Local\Temp\e5b17b3141c14d41664d0ff5b04d65f6a4688ba092477c156d47b0e99ddfb586.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1016-0-0x00007FF92F923000-0x00007FF92F925000-memory.dmp
memory/1016-1-0x000001CA3E930000-0x000001CA3E948000-memory.dmp
memory/1016-2-0x000001CA58F70000-0x000001CA59132000-memory.dmp
memory/1016-3-0x00007FF92F920000-0x00007FF9303E1000-memory.dmp
memory/1016-4-0x000001CA597B0000-0x000001CA59CD8000-memory.dmp
memory/1016-5-0x00007FF92F920000-0x00007FF9303E1000-memory.dmp