Analysis

  • max time kernel
    93s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-02-2025 04:19

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    f8d2d076628b54000aa24acf26cb1c10

  • SHA1

    144d46d805732f17740747ea036eaf57086ce941

  • SHA256

    3cfecdb8353318f5b7939ee04f4c53568d1538f47b7d2e380ea2260f8d3759c8

  • SHA512

    e06c02d1edbbcc5cfea3a360e5c5480a970d157f53bdd1449f8fe000a3e2f32f047a08864c6cb51796ef4df4c155d7cd1f5a66a756a4df9d93267517eee4845c

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTM0MTc4ODM2MzYyNzI5ODkyNw.GuQPad.VzcPaQaI5AHXhw2BV8WXxQ9L8CBKmn0S4XjEEs

  • server_id

    1341458677420392498

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/400-0-0x00007FFA80F33000-0x00007FFA80F35000-memory.dmp

    Filesize

    8KB

  • memory/400-1-0x00000123C99D0000-0x00000123C99E8000-memory.dmp

    Filesize

    96KB

  • memory/400-2-0x00000123E4090000-0x00000123E4252000-memory.dmp

    Filesize

    1.8MB

  • memory/400-3-0x00007FFA80F30000-0x00007FFA819F1000-memory.dmp

    Filesize

    10.8MB

  • memory/400-4-0x00000123E4890000-0x00000123E4DB8000-memory.dmp

    Filesize

    5.2MB

  • memory/400-5-0x00007FFA80F33000-0x00007FFA80F35000-memory.dmp

    Filesize

    8KB

  • memory/400-6-0x00007FFA80F30000-0x00007FFA819F1000-memory.dmp

    Filesize

    10.8MB