Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 05:00
General
- Target 2026-08-07_ec5d61a01359488fbc9a3a2e23d1ab1d_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 466KB
- Sample260807-fnbcdsxfmf
- SHA256 5c1cccbc13a4f34bdb131af1cb8b8e7bbd09f47841336e081e0d0025c61cd182
Malware Config
Extracted
-
discordrat
-
discord_token
MTUzNDY0NDY2NTk3NzAxNjM3MA.GyQDQm.r76kR_JTAy_kt-F-uF1Yz7OHbJOGHhSqCDoEhY
-
server_id
1534645353062596638
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_ec5d61a01359488fbc9a3a2e23d1ab1d_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ec5d61a01359488fbc9a3a2e23d1ab1d_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cheat_minecraft.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\cheat_minecraft.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cheat_minecraft.exe
memory/4348-11-0x0000023561BA0000-0x0000023561BB8000-memory.dmp
memory/4348-12-0x00007FF8A135F000-0x00007FF8A1360000-memory.dmp
memory/4348-13-0x000002357C2B0000-0x000002357C472000-memory.dmp
memory/4348-14-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-15-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-16-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-17-0x000002357D6D0000-0x000002357DBF8000-memory.dmp
memory/4348-18-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-19-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-20-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-21-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-22-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-23-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-24-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-25-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-26-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp
memory/4348-27-0x00007FF8A11D0000-0x00007FF8A1B74000-memory.dmp