discordrat | f1526ef4d09a43bbec188de0517dff4c4c8c0b23715e98e7a34da2794018e46c

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord rat.exe
Size 87KB
Sample260721-strmsaygng
SHA256 f1526ef4d09a43bbec188de0517dff4c4c8c0b23715e98e7a34da2794018e46c
MD5 25d21ef0ef6647b8ec26ad98b53154b0
SHA1 743c369b797a0d1155d0640c5f05f6c8bcd8cb4c
SHA512 aaa21cafcb4ddbbc4b9040ab8b0bc8ff8574839feaf7672f8c788d5bb6c72030600b8ce14274b509810aa538aa022f6ed28feb020b629e608ece335aa33bf5f3
SSDEEP 1536:nJbuFMfeJu4L+gXP4sLblQDEvH+b/rejH+ai/+k5QJNXrO6EZX5+/fkP9h9CyVAW:nJbuFMfe04L+gXP4sLblaEvH+b/rejez
TLSH
T13293C74827AC8903FABF6F7D587055238B36F426B939F24D0CCC55F854A2B868D14B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution discordrat persistence rat rootkit stealer

Malware Config

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	msedge.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2304	powershell.exe
1708	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
7	4128	Discord rat.exe
15	4300	temp.exe

Executes dropped EXE 2 IoCs

pid	Process
4300	temp.exe
4684	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com
12	pastebin.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\temp.exe	Discord rat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\msedge.exe	temp.exe
File created	C:\Windows\last.txt	temp.exe
File opened for modification	C:\Windows\last.txt	temp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1708	powershell.exe
1708	powershell.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
2304	powershell.exe
2304	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	Discord rat.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeIncreaseQuotaPrivilege	1708	powershell.exe
Token: SeSecurityPrivilege	1708	powershell.exe
Token: SeTakeOwnershipPrivilege	1708	powershell.exe
Token: SeLoadDriverPrivilege	1708	powershell.exe
Token: SeSystemProfilePrivilege	1708	powershell.exe
Token: SeSystemtimePrivilege	1708	powershell.exe
Token: SeProfSingleProcessPrivilege	1708	powershell.exe
Token: SeIncBasePriorityPrivilege	1708	powershell.exe
Token: SeCreatePagefilePrivilege	1708	powershell.exe
Token: SeBackupPrivilege	1708	powershell.exe
Token: SeRestorePrivilege	1708	powershell.exe
Token: SeShutdownPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeSystemEnvironmentPrivilege	1708	powershell.exe
Token: SeRemoteShutdownPrivilege	1708	powershell.exe
Token: SeUndockPrivilege	1708	powershell.exe
Token: SeManageVolumePrivilege	1708	powershell.exe
Token: 33	1708	powershell.exe
Token: 34	1708	powershell.exe
Token: 35	1708	powershell.exe
Token: 36	1708	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeIncreaseQuotaPrivilege	2304	powershell.exe
Token: SeSecurityPrivilege	2304	powershell.exe
Token: SeTakeOwnershipPrivilege	2304	powershell.exe
Token: SeLoadDriverPrivilege	2304	powershell.exe
Token: SeSystemProfilePrivilege	2304	powershell.exe
Token: SeSystemtimePrivilege	2304	powershell.exe
Token: SeProfSingleProcessPrivilege	2304	powershell.exe
Token: SeIncBasePriorityPrivilege	2304	powershell.exe
Token: SeCreatePagefilePrivilege	2304	powershell.exe
Token: SeBackupPrivilege	2304	powershell.exe
Token: SeRestorePrivilege	2304	powershell.exe
Token: SeShutdownPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeSystemEnvironmentPrivilege	2304	powershell.exe
Token: SeRemoteShutdownPrivilege	2304	powershell.exe
Token: SeUndockPrivilege	2304	powershell.exe
Token: SeManageVolumePrivilege	2304	powershell.exe
Token: 33	2304	powershell.exe
Token: 34	2304	powershell.exe
Token: 35	2304	powershell.exe
Token: 36	2304	powershell.exe
Token: SeIncreaseQuotaPrivilege	2304	powershell.exe
Token: SeSecurityPrivilege	2304	powershell.exe
Token: SeTakeOwnershipPrivilege	2304	powershell.exe
Token: SeLoadDriverPrivilege	2304	powershell.exe
Token: SeSystemProfilePrivilege	2304	powershell.exe
Token: SeSystemtimePrivilege	2304	powershell.exe
Token: SeProfSingleProcessPrivilege	2304	powershell.exe
Token: SeIncBasePriorityPrivilege	2304	powershell.exe
Token: SeCreatePagefilePrivilege	2304	powershell.exe
Token: SeBackupPrivilege	2304	powershell.exe
Token: SeRestorePrivilege	2304	powershell.exe
Token: SeShutdownPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeSystemEnvironmentPrivilege	2304	powershell.exe
Token: SeRemoteShutdownPrivilege	2304	powershell.exe
Token: SeUndockPrivilege	2304	powershell.exe
Token: SeManageVolumePrivilege	2304	powershell.exe
Token: 33	2304	powershell.exe
Token: 34	2304	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 1708	4128	Discord rat.exe	88
PID 4128 wrote to memory of 4300	4128	Discord rat.exe	92
PID 4300 wrote to memory of 4684	4300	temp.exe	93
PID 4300 wrote to memory of 2304	4300	temp.exe	95

C:\Users\Admin\AppData\Local\Temp\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"
1⤵
- Downloads MZ/PE file
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System32\temp.exe
  "C:\Windows\System32\temp.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\msedge.exe
    "C:\Windows\msedge.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Windows\System32\temp.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogOn; Register-ScheduledTask -TaskName 'UpdateSvc' -Action $Action -Trigger $Trigger -User $env:USERNAME -RunLevel Highest -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5gh11kev.syc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5gh11kev.syc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

temp.exe

Path C:\Windows\System32\temp.exe
Size 13.7MB
SHA256 b0d5900cbc073b71878fcb0c1d9377e13b759876a0689205ac55c274e245b127
MD5 4bb3d72fa87b9fccfd53757e98b6950b
SHA1 fc422b2c006b74aff6eb47f6707aa80b9aa5f942
SHA512 935242bc489f2c816d30240d1790448b05a9d68c73292f045ad4919b591ce3cc0d513cccf4c320ab9a015a14547fe8a301291b64f64490cc3efe50393b9489bc
SSDEEP 196608:P9RqywLxg3DdocGGi7NAf/V6UZ10gDIcz7:FR6NgT1i7N6lZ10W
TLSH
T12DE6AD02E3FC42A9E5BFC278C566551BE7B278451720EBDF115489A92F33BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Windows\msedge.exe
Size 12.1MB
SHA256 0fd0e8111e241e89c41c08ebce27650b90d1b95163d874892acea105299562f4
MD5 1766f971c84cdabf9ad35ffa364987d2
SHA1 c88081de4c7f7a3ecbc03cb0f2e050cc43474127
SHA512 7eee301f5c9d598781ca6d3008450f2185973ab7ffec76b561bc3b6974cbcd9e89f4c5dc42166f4faf6c676b50ba7a364402008183ec38fea9c270af1d7bd88e
SSDEEP 196608:zVZ5CDbhBBKXCnDorPhPvXBrNhIV4n77Kk6STaOLCj:YtfKXCnDorRVIGn7+ITkj
TLSH
T146D6AF03B5DB4CD5C9C59378DA8392316734BC668BB51AAF3684F2653D73AC47A2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1708-18-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/1708-15-0x00000269184E0000-0x00000269184FE000-memory.dmp

Download

memory/1708-8-0x000002697F220000-0x000002697F242000-memory.dmp

Download

memory/1708-21-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/1708-20-0x00000269184D9000-0x00000269184DF000-memory.dmp

Download

memory/1708-17-0x000002697D9C0000-0x000002697D9CA000-memory.dmp

Download

memory/1708-16-0x0000026918500000-0x00000269185B2000-memory.dmp

Download

memory/2304-47-0x000001E2F3A50000-0x000001E2F3A6E000-memory.dmp

Download

memory/4128-22-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-33-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-1-0x00007FFEB989F000-0x00007FFEB98A0000-memory.dmp

Download

memory/4128-11-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-10-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-7-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-4-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-30-0x0000025A73120000-0x0000025A732E2000-memory.dmp

Download

memory/4128-32-0x0000025A73820000-0x0000025A73D48000-memory.dmp

Download

memory/4128-12-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-34-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-35-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-3-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-9-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-2-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp

Download

memory/4128-0-0x0000025A58640000-0x0000025A5865A000-memory.dmp

Download

memory/4684-41-0x00007FF75EBF0000-0x00007FF75F1E0000-memory.dmp

Download