Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 12:56
General
- Target DiscordRatC#.exe
- Size 73.3MB
- Sample260718-p6fjhaft7x
- SHA256 ee1ad186b64bc68fdc9bb5bc024d80a1a9eae850d0102b4af010a5e793909d90
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiscordRatC#.exe"C:\Users\Admin\AppData\Local\Temp\DiscordRatC#.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds $image = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height) $graphics = [System.Drawing.Graphics]::FromImage($image) $graphics.CopyFromScreen($screen.X, $screen.Y, 0, 0, $screen.Size) $image.Save('C:\Users\Admin\AppData\Local\Temp\screenshot_20260718_135837.png') $graphics.Dispose() $image.Dispose()2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\DiscordRatC#.exe"C:\Users\Admin\AppData\Local\Temp\DiscordRatC#.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds $image = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height) $graphics = [System.Drawing.Graphics]::FromImage($image) $graphics.CopyFromScreen($screen.X, $screen.Y, 0, 0, $screen.Size) $image.Save('C:\Users\Admin\AppData\Local\Temp\screenshot_20260718_135834.png') $graphics.Dispose() $image.Dispose()2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
screenshot_20260718_135834.png
memory/3232-11-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-12-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-7-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-8-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-9-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-10-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-1-0x00007FFC242BF000-0x00007FFC242C0000-memory.dmp
memory/3232-6-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-13-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-15-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-17-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-18-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-5-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3232-4-0x00000294FA460000-0x00000294FA482000-memory.dmp