Resubmissions
31-01-2025 12:55
250131-p5775awlew 10Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
-
submitted
31-01-2025 12:55
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
bdd15fd36f169d01f060343ab895531b
-
SHA1
abe280800f095a1b915c43c9076997ac3f0bbe9d
-
SHA256
0141236858e4053046889eaffb816882c7e4b80b113e9111d159b52dab318516
-
SHA512
f05db5c90db19ff34ca836ca906216b4cc52ac09c7c55d0482b2c1b71c398d3d70296dd07dc02c45a2a7ba243a970fa969ea5aa1606c4d00b04bd24cbd282110
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+hPIC:5Zv5PDwbjNrmAE+xIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMzNDg2ODQ0OTQ4MjI0ODI1NA.GIkc8R.EzznDmSguUjpMP876y07cZbo71yP_fd9iHveHA
-
server_id
1334868116416761927
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
56KB