discordrat | f44e7ea62659fa2c1c75ecf12b890ecd83f09ee2a9e7d02387189cfed3dd39e7

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/07/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skelliess.png - Copy.exe
Size 570KB
Sample260716-dbs1kae181
SHA256 f44e7ea62659fa2c1c75ecf12b890ecd83f09ee2a9e7d02387189cfed3dd39e7
MD5 12c20c6556c481c543b6a20ecc7c59f9
SHA1 9fc0cb72df25536b05a064bae2b2a1d6715bca5a
SHA512 7bd2ce311a741d425046303f6be4adc59b05b6d537afcdf5c29cffe491b8b85230615f7e087b474aed51747ea60a3179de65e9b195c76c30484108c9b5ceb306
SSDEEP 12288:CmiMZvN43+u85Bpw+YMRkc9TgOMoQPiaqZDB25A:LnvS+55BpfRX9TgOMuVDB25A
TLSH
T11AC4AE19D7F405FDE1B3E578CD834902EB76784947B1E78F03A499A61F232A09E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	skelliess.png - Copy.exe

Executes dropped EXE 1 IoCs

pid	Process
3784	skellies.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	skelliess.png - Copy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2112	mspaint.exe
2112	mspaint.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	skellies.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2112	mspaint.exe
2112	mspaint.exe
2112	mspaint.exe
2112	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 2112	3896	skelliess.png - Copy.exe	84
PID 3896 wrote to memory of 3784	3896	skelliess.png - Copy.exe	90

C:\Users\Admin\AppData\Local\Temp\skelliess.png - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\skelliess.png - Copy.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\skellies.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\skellies.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\skellies.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

skellies.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\skellies.exe
Size 79KB
SHA256 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
MD5 d13905e018eb965ded2e28ba0ab257b5
SHA1 6d7fe69566fddc69b33d698591c9a2c70d834858
SHA512 b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP 1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
TLSH
T18F83C74C67DC4A03FA7F5E7E24315682C633BA13AD65F64E09CC50FC18B6B818952B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skellies.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\skellies.png
Size 107KB
SHA256 c05a00fe4996eeb023fee3e924a409ee45e6ef4dbbe69de2d5d2c8106eaa8e2c
MD5 6442712b04fce74d652aa04b7a76e88a
SHA1 982f3b388a16ca440ffadc705e0160d7a211c655
SHA512 377e1109145ad0d8a975d9715d738dce3e8e01f5b8129d1dddeb5624db22fc12ac893b8aad75f28f82dec61a9830d533d4a96067d27fd51e7f9b37d91e82da74
SSDEEP 3072:Bkl38Cb+UrOKBoRaMnZgSaSVH0RJ1P0qxlt:B438Cb+uiaMnZgSLBgJ5Lt
TLSH
T153B31257DC715B8AFE4987327A435DCC1E5AB469E4CA2C04F0B4F228956CB4CDBA034A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3784-26-0x000001FE7E870000-0x000001FE7E888000-memory.dmp

Download

memory/3784-27-0x000001FE7FA30000-0x000001FE7FBF2000-memory.dmp

Download

memory/3784-28-0x000001FE1A6A0000-0x000001FE1ABC8000-memory.dmp

Download