Analysis
-
max time kernel
67s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
18-02-2025 14:36
Errors
Reason
Machine shutdown
General
-
Target
echo-5A7E85-dWEyYXBi-wZdZlN-f.exe
-
Size
109KB
-
MD5
8ff7691ce984d8240d93140470ee90da
-
SHA1
e3f1ae792adab6026152b2a1733d42f91eb8b4b0
-
SHA256
c3f50c1a06d78569baaffb4c0078e145541b76179aece4283936f209291208fd
-
SHA512
8ab51ffc0fd628718f757ae5efba9cd781a17310350d2f4098b2785371714dffa5a398683c41e0376dd6256a5de4cf91c24e0f78af9d830e715178c877a5dbf3
-
SSDEEP
3072:EbRltj4wkI6yNKv0YhNq/BVPsbwNrDZWsH:Ent239qpdsb+r
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTM0MTQxNTExNjMxNDM3ODMzMg.GLIZah.vcBmaDTBMQ_tIpXZH3Eu4541gUQs30_4_YK8fg
-
server_id
1341228042776875089
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\echo-5A7E85-dWEyYXBi-wZdZlN-f.exe"C:\Users\Admin\AppData\Local\Temp\echo-5A7E85-dWEyYXBi-wZdZlN-f.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
128KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB