Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
29-01-2025 04:24
General
-
Target
executor.exe
-
Size
78KB
-
MD5
10b2da716481ed70b391ae0f97d0e64e
-
SHA1
22ccb5a19045d2db496ad0c5c0326e620e6e620f
-
SHA256
63e676624115c3fd9febe7649f8c65dd65cb20df39595cbcc96b3781d1dee83c
-
SHA512
f5dee05290a9a66975495c061fba0b9e567fe57ddff626b517388d246cacb825f92f0e6670a7f064307d478b49ceaf0f7d9f18bd8c615ca53b7fadb362d33b8c
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMzMzk4NzY2MTExMDU3NTEzNA.GUgCAs.PJkCkd2O0ZfCoCsqkLw6C4P8onABarxkOywQhI
-
server_id
1332933302335832155
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs
UAC Bypass Attempt via SilentCleanup Task.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\executor.exe"C:\Users\Admin\AppData\Local\Temp\executor.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I2⤵
- Abuse Elevation Control Mechanism: Bypass User Account Control
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C whoami2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
680KB
-
Filesize
10.8MB
-
Filesize
10.8MB