Overview

overview

7

Static

static

3

DiscordRAT.exe

windows10-2004-x64

7

DiscordRAT.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    901s
  • max time network
    481s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DiscordRAT.exe
  • Size 102.7MB
  • Sample260812-2bf8rsfb53
  • SHA256 9891369cc0ca817192554fbd57e11a49f9bd8f93e095e24e05f41fb76c08db8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:724
    • C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe
      "C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4332
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4532
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:4012

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_asyncio.pyd
            • Size 76KB
            • SHA256 13b374175108c266f4a5bdf907f990d0ccd5b486d0313856e08a60ba9bf856cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_bz2.pyd
            • Size 85KB
            • SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_ctypes.pyd
            • Size 139KB
            • SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_hashlib.pyd
            • Size 67KB
            • SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_lzma.pyd
            • Size 157KB
            • SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_overlapped.pyd
            • Size 56KB
            • SHA256 43b9e0bdc41646fc363f144bf050600dab647ce9e7c251a2b6d0e75358cb10cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_queue.pyd
            • Size 35KB
            • SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_socket.pyd
            • Size 85KB
            • SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_ssl.pyd
            • Size 180KB
            • SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_wmi.pyd
            • Size 39KB
            • SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\_zstd.pyd
            • Size 491KB
            • SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\base_library.zip
            • Size 1.3MB
            • SHA256 3d4a94fa45bd3e0c7703a3c0e72b28862c14d4e45e213c63804840207a46f89d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\__init__.py
            • Size 6KB
            • SHA256 674817e87409bc589608ef9f4dd4c1a49f600b5e85ca8b106b3b0a9eab5c46cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config-3.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\config-3.py
            • Size 748B
            • SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\config.py
            • Size 123B
            • SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\data\__init__.py
            • Size 73B
            • SHA256 f4ce16721ed7f623a4dcc443ba600d1856db610cb2c3d53c13a8ca028cc68f6d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            load_config_py3.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\load_config_py3.py
            • Size 253B
            • SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\mat_wrapper\__init__.py
            • Size 1KB
            • SHA256 c44707ea1c76f35518ae572b6c1989d76c2ada7e850432e41805dfe112d4e306
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\misc\__init__.py
            • Size 38B
            • SHA256 495bd79594cce174673e372c85c4dd8f4ffdf2b3a73fd4623955b0d55de0d462
            • MD5 SHA1 SHA512
            Submit Download

            version.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\misc\version.py
            • Size 95B
            • SHA256 c93a418793fcb15b9b4316c0741b8336740e490e94f3b7d1ebe8cd5f6f23815c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\typing\__init__.py
            • Size 4KB
            • SHA256 f8a066f22a98b56641a69200f0aaf9c3b5832b2f59f57862e56289cced8d9179
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\utils\__init__.py
            • Size 344B
            • SHA256 2b16990b35b569af1ca7239dc10f7b24ec62f27a46626b1e2f1271d2e1aa3554
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            version.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\cv2\version.py
            • Size 96B
            • SHA256 fc17efee9203c23cac641981068621e80d3b0bbabe459f4133c9b2b4d91957fb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\libcrypto-3.dll
            • Size 5.0MB
            • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\libssl-3.dll
            • Size 776KB
            • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libscipy_openblas64_-327b2e0bcffce2882e0dc04cdeb4eaa6.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\numpy.libs\libscipy_openblas64_-327b2e0bcffce2882e0dc04cdeb4eaa6.dll
            • Size 19.5MB
            • SHA256 327b2e0bcffce2882e0dc04cdeb4eaa6382ed4dba29871b6176fa157782f484a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
            • Size 561KB
            • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiarray_umath.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
            • Size 3.7MB
            • SHA256 8a6755d3fcc31b0fa0f891a715b9674f592be67c78bd8bc7a66cc8b678acdf6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _umath_linalg.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
            • Size 109KB
            • SHA256 80b2fd55ef96eec642b7bd2b2b11924342588ebcdc6a1b53bfdd86037d634980
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\python3.dll
            • Size 72KB
            • SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\python314.dll
            • Size 6.5MB
            • SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\select.pyd
            • Size 32KB
            • SHA256 56441c3148743a0890986ccdf93fea8174155b0ee84db2493151f075d8e7c51a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Lorem ipsum.txt
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
            • Size 1KB
            • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7242\ucrtbase.dll
            • Size 1.3MB
            • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4332-1278-0x00007FFD8B9A0000-0x00007FFD8CD35000-memory.dmp
            Download