Analysis
- max time kernel
131s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20241007-fr - resource tags
- submitted
01/01/2025, 04:28
Errors
General
- Target virus/resources/Discord.exe
- Size 78KB
- Sample250101-e3m43axlal
- SHA256 e82cec44f57277f6172f89f7107b46754e5d0f3aed3ce61c8dac13b258218dcf
Malware Config
Extracted
-
discordrat
-
discord_token
MTMyMzg2NTkxNDI4NjAxODY2NQ.GWEzhT.LfNT1TRxrNi0wH4g7-xuQFdnyioFM2jNkyqNMk
-
server_id
1323845201596387451
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\virus\resources\Discord.exe"C:\Users\Admin\AppData\Local\Temp\virus\resources\Discord.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C del /s /q C:\Windows\System32\*2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C del /s /q C:\Windows\System32\2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C shutdown2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown3⤵
-
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa392d055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1876-0-0x00007FFC62AB3000-0x00007FFC62AB5000-memory.dmp
memory/1876-1-0x0000025A2C3C0000-0x0000025A2C3D8000-memory.dmp
memory/1876-2-0x0000025A46B70000-0x0000025A46D32000-memory.dmp
memory/1876-3-0x0000025A2E0B0000-0x0000025A2E0F2000-memory.dmp
memory/1876-4-0x00007FFC62AB0000-0x00007FFC63571000-memory.dmp
memory/1876-5-0x0000025A47270000-0x0000025A47798000-memory.dmp
memory/1876-6-0x0000025A46E50000-0x0000025A46F52000-memory.dmp
memory/1876-7-0x00007FFC62AB3000-0x00007FFC62AB5000-memory.dmp
memory/1876-8-0x00007FFC62AB0000-0x00007FFC63571000-memory.dmp
memory/1876-9-0x00007FFC62AB0000-0x00007FFC63571000-memory.dmp