Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2024 20:09
Behavioral task
behavioral1
Sample
189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe
Resource
win10v2004-20241007-en
General
-
Target
189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe
-
Size
78KB
-
MD5
7df646d7e240335e6521ee91d890ec4f
-
SHA1
cf40fc9613f998b812bebb8e2ef92d197c2bc290
-
SHA256
189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051
-
SHA512
a054a08de1a599788156e2bbb6fd9dd8132a517ac683a4da54ed5d54fc64f0f3e72d810b5ec196ff12b9cd2993a0448fd97d6c791a804a825a92e19aa1e0a385
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+uPIC:5Zv5PDwbjNrmAE+KIC
Malware Config
Extracted
discordrat
-
discord_token
MTMyMTE2Mzk1MTU5NzE1ODQ4MA.GATWmz.qBhTuxTj7H-lFM4Qiw6R3YKhhhQWW7_MiEQ3Yo
-
server_id
1321164622329544734
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 11 discord.com 13 discord.com 21 discord.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 628 189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe