Analysis
- user interaction
yes - max time kernel
648s - max time network
585s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/08/2026, 21:46
General
- Target builder.exe
- Size 10KB
- Sample260828-1mxt8aec28
- SHA256 ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
Malware Config
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\builder.exe"C:\Users\Admin\AppData\Local\Temp\builder.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOnDeveloperFeatures DeveloperUnlock1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" shell32.dll,Options_RunDLL 71⤵
-
C:\Users\Admin\Desktop\Discord rat.exe"C:\Users\Admin\Desktop\Discord rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Discord rat.exe"C:\Users\Admin\Desktop\Discord rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1008-10-0x000001D080530000-0x000001D080A58000-memory.dmp
memory/2720-0-0x00000000001D0000-0x00000000001D8000-memory.dmp
memory/2720-1-0x00000000051A0000-0x0000000005746000-memory.dmp
memory/2720-2-0x0000000004BF0000-0x0000000004C82000-memory.dmp
memory/2720-3-0x0000000004BC0000-0x0000000004BD0000-memory.dmp
memory/2720-4-0x0000000004B40000-0x0000000004B4A000-memory.dmp
memory/2720-5-0x0000000004BC0000-0x0000000004BD0000-memory.dmp
memory/2720-6-0x00000000081D0000-0x00000000082F2000-memory.dmp
memory/5160-8-0x000001CACEAD0000-0x000001CACEAE8000-memory.dmp
memory/5160-9-0x000001CAE9150000-0x000001CAE9312000-memory.dmp