Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 21:30
General
- Target Client-built.exe
- Size 78KB
- Sample260415-1cf4qaaw4p
- SHA256 515629ea8fa5f6497d42586ff7be0467aae71293412f6e8f965c3bf536b6070a
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTM1NzY1NTgwNzEzNDUzNTc0MA.Gyn_-2.pG8AkQukED4fB452Ye2DboANfnYEvMhFxAHz-I
-
server_id
1357650680734548120
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3240-0-0x0000020595DF0000-0x0000020595E08000-memory.dmp
memory/3240-1-0x00000205B0560000-0x00000205B0722000-memory.dmp
memory/3240-2-0x00000205B04E0000-0x00000205B04F0000-memory.dmp
memory/3240-3-0x00000205B0D60000-0x00000205B1288000-memory.dmp
memory/3240-4-0x0000020596220000-0x000002059622C000-memory.dmp
memory/3240-7-0x00000205B04E0000-0x00000205B04F0000-memory.dmp
memory/3240-6-0x0000020597AC0000-0x0000020597AD2000-memory.dmp
memory/3240-5-0x0000020596240000-0x0000020596249000-memory.dmp