Analysis
-
max time kernel
125s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 22:16
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
6ab9c1eda7daf07dca994f5f6394d33a
-
SHA1
0f3e3275c7738c28650233cfdefd58a75bc3148b
-
SHA256
45f4ce529bfdf2ea1d1fc70f5a2737a9d2977172930c5570c56e9dbc44b6b391
-
SHA512
e65f8611364cc2fb93f4d55828be33251bf150448eea073c8437396e4d22ea58c47c1f46a03742d063a8e0aa59f6454eaf9c20c76057811dd4506be4e9dc4c18
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC
Malware Config
Extracted
discordrat
-
discord_token
MTMwMTU4MzM1NDcxNzY2NzQxOQ.GE07zS.Z10SUgnyFbaVbeOcOiJUNXKaDOhU6MKfgqOx8Q
-
server_id
1335294781940830239
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x4981⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
940B
MD594a6a7a5feb0452e71bd4468c576e3a1
SHA164c6e16e83c8bb8ab761c19ab777de7ed6a72031
SHA25698a40b2c153cec4e050cf54fde59a74aed4bd39da83682f7618c02cdba852898
SHA51206404c1a98d262f124e520e33fe75f666b4673bdc40c14e6002fd91a53d49c2d9ba95c87d1a496d2edac8f78a148bf044de32fdfda19b928d7fb6197557c5629
-
Filesize
10.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
680KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
472KB
-
Filesize
72KB
-
Filesize
120KB