Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/05/2026, 23:10
General
- Target clickme.exe
- Size 520KB
- Sample260502-252rkagy5x
- SHA256 3df328c834c838ea5c1edcb7f5abb319f0b3b178e81bedd347ceee5d5807975c
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTUwMDI1ODkyNjgzNzYzMzExNA.GAqIZZ.2Dqy7EaLgyHWsfBOqyM_FROEgWuHLlsOmGorS8
-
server_id
1500260056418226186
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\clickme.exe"C:\Users\Admin\AppData\Local\Temp\clickme.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rat.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rat.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
rat.exe
memory/1920-18-0x0000021D86670000-0x0000021D86ADC000-memory.dmp
memory/3300-14-0x00000251B8E90000-0x00000251B8EA8000-memory.dmp
memory/3300-15-0x00000251D34E0000-0x00000251D36A2000-memory.dmp
memory/3300-16-0x00000251D3890000-0x00000251D38A0000-memory.dmp
memory/3300-17-0x00000251D3DD0000-0x00000251D42F8000-memory.dmp
memory/3300-19-0x00000251B92D0000-0x00000251B92DC000-memory.dmp
memory/3300-21-0x00000251D3890000-0x00000251D38A0000-memory.dmp
memory/3300-20-0x00000251D3480000-0x00000251D3492000-memory.dmp