Analysis
-
max time kernel
62s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 19:09
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
cfd0aaeb9398c21d7909c7e0e4251e5d
-
SHA1
2b37850cc14cf0bf8f5b37d5af73497271541aa3
-
SHA256
c0ed5bfe17adceb9e9185071d02b801d96e3f392079e4900420aa2b78def1728
-
SHA512
3cd60b4547df54e37952dbd6a6a7bb68180cdd7fe42ccb3adeeade23b2c1ce64c7320dbd12cf18e30682fb507be0038c158e0e8c415aac54cd59b8bdf061e762
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMyNDQ1MTcxNzcxODQ3NDc2Mg.GQa-G-.ZDxQ-KBMJu36zv0n9jlzDvCe1wNs6ml3C1LUw8
-
server_id
1324451611644268618
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2412 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2484 2096 Client-built.exe 31 PID 2096 wrote to memory of 2484 2096 Client-built.exe 31 PID 2096 wrote to memory of 2484 2096 Client-built.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2096 -s 6002⤵PID:2484
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2412