Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
24/06/2026, 12:29
General
- Target Client-built.exe
- Size 78KB
- Sample260624-ppaa6ab14t
- SHA256 36e1ff7ba867c35d1de21fdc31a3819471df2ff89b51284c3d4adbf06cf1c407
Malware Config
Extracted
-
discordrat
-
discord_token
MTUxOTMxNzI1ODQwNzc3MjMyMA.Gp8Hlg.6HwnOpBGu4I09mHhc4G_vBwbSWTDUQL_lvl_50
-
server_id
1519316774787485776
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3712-0-0x0000019AF9E20000-0x0000019AF9E38000-memory.dmp
memory/3712-2-0x0000019AFC630000-0x0000019AFC7F2000-memory.dmp
memory/3712-1-0x00007FFD3FD4F000-0x00007FFD3FD50000-memory.dmp
memory/3712-3-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-4-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-5-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-6-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-7-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-8-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-9-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-10-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp
memory/3712-11-0x00007FFD3FBC0000-0x00007FFD40564000-memory.dmp