Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 10:02
General
- Target 2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 464KB
- Sample260717-l2tnsact21
- SHA256 fb16150e272e5a3ea8cabf349c5fed54bc62002784e43f747ae649d4fb9ccfae
Malware Config
Extracted
-
discordrat
-
discord_token
MTUyNzE1MDgyMTk0NTYzOTAxNQ.Gfu_97.Py6-_X6MonQRpvUYi5khLoc8KpaI6YuGw-CQnE
-
server_id
1527151478639427594
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/4120-11-0x0000027EB7150000-0x0000027EB7168000-memory.dmp
memory/4120-12-0x00007FF9D75CF000-0x00007FF9D75D0000-memory.dmp
memory/4120-13-0x0000027ED1950000-0x0000027ED1B12000-memory.dmp
memory/4120-14-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-15-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-16-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-17-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-18-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-19-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-20-0x0000027ED2150000-0x0000027ED2678000-memory.dmp
memory/4120-21-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-22-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-23-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-24-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-25-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-26-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-27-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/4120-28-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp