Analysis
-
max time kernel
41s -
max time network
43s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
17-01-2025 22:14
General
-
Target
ft.exe
-
Size
78KB
-
MD5
f91ccf4508c5b38c655dfbbee715a8a4
-
SHA1
b1bd3d4700019d99bd74b00c8fe3e7fe62c00a9b
-
SHA256
ab9903424f54db2436f93dea75b3da47008d68978d5209b5483db24d2b6351da
-
SHA512
d69c647eda894669cc926d1279de76258dff54f578279cd1ef0c520e920e534ccf8843f5ab5b8feaae8cfdd2952906c09ac82c5fb8c62c3746a0d1633465e761
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dPIC:5Zv5PDwbjNrmAE+NIC
Malware Config
Extracted
discordrat
-
discord_token
MTE2OTcxNTQ5MDk0MDI2NDYwOQ.GT9jXS.u1NUz6EhjEOGBwHNrMPtou3JF7iKZ6qZDdwdg0
-
server_id
1328732385663258774
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ft.exe"C:\Users\Admin\AppData\Local\Temp\ft.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d6d3499e5dfe058db4af5745e6885661
SHA1ef47b148302484d5ab98320962d62565f88fcc18
SHA2567ec1b67f891fb646b49853d91170fafc67ff2918befd877dcc8515212be560f6
SHA512ad1646c13f98e6915e51bfba9207b81f6d1d174a1437f9c1e1c935b7676451ff73a694323ff61fa72ec87b7824ce9380423533599e30d889b689e2e13887045f
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB