Analysis
-
max time kernel
41s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-01-2025 01:31
General
-
Target
Main.exe
-
Size
78KB
-
MD5
5ed06daf364ad1a25e86081b936f2da5
-
SHA1
63bae7ed9d11c6300c6b5c7e9b0863ef12f17acd
-
SHA256
430433eec099a6666339218cf1089d6fb2626758930fec1bba78501c9be377be
-
SHA512
d9b89095145bc68bb17faf51a9e688724ff7243d52fdd2620424e18a834da8fbfacd2d7ac6e1530582b4637ac4b3a87ba4faa383617f08f7d0b60bfe23a22fa5
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+mPIC:5Zv5PDwbjNrmAE+CIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMxNzEzNDQ3MzExMjA2NDA5MA.GJ-fqs.71xBerWaoZN0IKEdibuQAKu9YmgLklg_2D1YY8
-
server_id
1317524885165314078
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Main.exe"C:\Users\Admin\AppData\Local\Temp\Main.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x318 0x4d01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
680KB
-
Filesize
10.8MB
-
Filesize
10.8MB