Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/07/2026, 12:31
General
- Target decompiler.exe
- Size 78KB
- Sample260724-pp7xeszfrd
- SHA256 407f9ea6df1cb7383d6e8b6047b80aeb56737943f3c11398aab66f6386f834f4
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTUzMDE4NDgzMzg5MDc4MzMxMg.GSi6yJ.vPqNiCcCCEONtmWikHZYQ-SYLyF-KdQ3QLxTe8
-
server_id
1522851259575570574
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\decompiler.exe"C:\Users\Admin\AppData\Local\Temp\decompiler.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x44c1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1800-0-0x000002DB4D440000-0x000002DB4D458000-memory.dmp
memory/1800-1-0x000002DB67B20000-0x000002DB67CE2000-memory.dmp
memory/1800-2-0x000002DB67B00000-0x000002DB67B10000-memory.dmp
memory/1800-3-0x000002DB68320000-0x000002DB68848000-memory.dmp
memory/1800-4-0x000002DB67B00000-0x000002DB67B10000-memory.dmp
memory/1800-5-0x000002DB67DF0000-0x000002DB67E9A000-memory.dmp
memory/1800-9-0x000002DB67B00000-0x000002DB67B10000-memory.dmp