Analysis
-
max time kernel
461s -
max time network
877s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
16/04/2025, 20:05
General
-
Target
friegpj.exe
-
Size
521KB
-
MD5
fa686ae2f0713ae1b02296047ebcc87d
-
SHA1
c07002d6a973789c28091495fc36e7ce1f2db93d
-
SHA256
445e8e980c9ed096e55898149a625d436686b24d870c0ed08ae81b97ed4d5866
-
SHA512
1ccb1877fe52a399a1dc4c2ac1de8c3f56772b13cd0bec053558fc90334bd291894b49f57120f0f9388431498df91be082ae5ac7bc18db3b5abc367d521f3f51
-
SSDEEP
12288:ZyveQB/fTHIGaPkKEYzURNAwbAg8XIAVVsaz1J/CS:ZuDXTIGaPhEYzUzA0qpdzHaS
Malware Config
Extracted
discordrat
-
discord_token
MTM2MTg0MjQwNDY2Mjk2ODQ0Mg.GbO_ZS.7BypD_7qCEnOjM1Bcz1ic7kfHpyO7HfeBvYCVY
-
server_id
1361842784121782312
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\friegpj.exe"C:\Users\Admin\AppData\Local\Temp\friegpj.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5f218c42ef38080b9cdeeefc930a9323e
SHA1007cdb5163614a1de3fe6af210191e6ec53ae6e5
SHA2567d76d3c6e37efdd8910316fccfbe5bff4cc745a192b71ed3e8aeda9517744a21
SHA512fcd22e044fe66ac7881b0319ba01fb00f8cae89c5d933adbfe80ea2cd685c42ac79c06969626b2f1e0e1635291b7959c5744744f95f559d2c71f1e1df7d606cc
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB