Analysis

  • max time kernel
    109s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2025, 23:59

General

  • Target

    PikacuTestCATrusterSetup1.exe

  • Size

    78KB

  • MD5

    951de53e5a15496809d229467f9bd06c

  • SHA1

    78c56e0ac8c1deee143387c06c32f0cd06a1b62c

  • SHA256

    4f1f07f7fe2572f02cb7ee748e994081684c23132e98a022f7a3ffaaec1753e9

  • SHA512

    6950aad78896605bc210486c4e373462f893f0fda60f07a338ad7c114d04093cc537a7890bad7e787648764ad64d34805f28ae256a07c448d74f83c485811e34

  • SSDEEP

    1536:r2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIC:rZv5PDwbjNrmAE+VIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMxOTQ0NzE2Njc5NTY0OTA3NA.GSua6l.BHis8NFhnGhvzs_sNcA7gxK12CE-dopfaLfAO

  • server_id

    1343684421986943051

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PikacuTestCATrusterSetup1.exe
    "C:\Users\Admin\AppData\Local\Temp\PikacuTestCATrusterSetup1.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4920-0-0x00007FFAF18E3000-0x00007FFAF18E5000-memory.dmp

    Filesize

    8KB

  • memory/4920-1-0x00000137575C0000-0x00000137575D8000-memory.dmp

    Filesize

    96KB

  • memory/4920-2-0x0000013771BB0000-0x0000013771D72000-memory.dmp

    Filesize

    1.8MB

  • memory/4920-3-0x00007FFAF18E0000-0x00007FFAF23A1000-memory.dmp

    Filesize

    10.8MB

  • memory/4920-4-0x00000137723B0000-0x00000137728D8000-memory.dmp

    Filesize

    5.2MB

  • memory/4920-5-0x00007FFAF18E0000-0x00007FFAF23A1000-memory.dmp

    Filesize

    10.8MB