Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 01:22
General
- Target 2026-07-30_933687e639b848298f97b6223fe3e878_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 34.3MB
- Sample260730-brplzaaa35
- SHA256 ad795a41f1c3e5cf7a1e505caf3fdd44a438150f61e88fda060cf36c6c9abd75
Malware Config
Extracted
-
discordrat
-
discord_token
MTQ4NDUxMTk3NTg0NDA4OTg1Ng.GAJhaQ.qo6TmXVqlYnswCv27DvUqqrDc7ubC1OdlnC8UU
-
server_id
1484514542733099130
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 5 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_933687e639b848298f97b6223fe3e878_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_933687e639b848298f97b6223fe3e878_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bleah.exe"C:\Users\Admin\AppData\Local\Temp\bleah.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
LocalMLS_3.wmdb
WMSDKNS.XML.bak
GlassEffect3.mp4
bleah.exe
wmsetup.log
memory/2536-93-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-97-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-44-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-58-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-127-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-129-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-57-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-60-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-59-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-45-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-74-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-75-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-76-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-77-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-79-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-78-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-80-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-98-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-83-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-82-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-84-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-85-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-86-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-87-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-88-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-89-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-91-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-90-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-92-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-42-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-94-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-96-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-43-0x0000000007470000-0x0000000007480000-memory.dmp
memory/2536-95-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-81-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-99-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-101-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-100-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-102-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-104-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-103-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-105-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-106-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-108-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-107-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-109-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-110-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-111-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-113-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-112-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-114-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-115-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-116-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-118-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-117-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-119-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-121-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-120-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-122-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-123-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-124-0x00000000073E0000-0x00000000073F0000-memory.dmp
memory/2536-126-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-125-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/2536-128-0x000000000AA10000-0x000000000AA20000-memory.dmp
memory/5280-55-0x000001AD71940000-0x000001AD71B02000-memory.dmp
memory/5280-54-0x000001AD57280000-0x000001AD57298000-memory.dmp
memory/5280-56-0x000001AD72190000-0x000001AD726B8000-memory.dmp