Analysis
- user interaction
yes - max time kernel
900s - max time network
344s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Real.sfx.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
900 seconds
General
- Target Real.sfx.exe
- Size 470KB
- Sample261104-vchdwsys5n
- SHA256 adf23cec80e8673a33048b80185a2ae7ec005a3013be2c422ef415f87255d4e2
- MD5 fe6e6611f6d037fff32752bdd9a3fbd1
- SHA1 8bd15c1b3054574174b0c6e20da3f20cd24c6eb3
- SHA512 7bafa2a7458ba9314ca3d9ca208c5088f38c04c1ebe66e1ef5b571aaa08112036c6f0b710b97553fac866d0f874a860f448b2fb342cb66f8d29979100de860ac
- SSDEEP 6144:Xj1zho1x2kD02IXYwa6fWnUh7bxa57SzYCO8gG4iR+v/74D8+xFlIWItgI:thoVY2+LfWvRSECKG4iRkTuuWdI
- TLSH T174A47D19D7E404FDE0B7E578CD928912EB767C4A47B1E68F03E459A61F232908E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTU2NzU1MjIxODQxMDc4MjgzMA.GYvCJI.BHZED6ckZ6EsO6DJFC9p1XxTzeAbJTSDicTmrg
-
server_id
1490013263037988965
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Executes dropped EXE 1 IoCs
pid Process 2728 Real.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Real.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Real.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1692 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2728 Real.exe Token: SeDebugPrivilege 1692 taskmgr.exe Token: SeSystemProfilePrivilege 1692 taskmgr.exe Token: SeCreateGlobalPrivilege 1692 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2728 1844 Real.sfx.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Real.sfx.exe"C:\Users\Admin\AppData\Local\Temp\Real.sfx.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Real.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Real.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5936
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1692
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:3532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\real.exe
- Size 78KB
- SHA256 67388b09cbfa9cfe26315286327c76430f62c4daf1c78e0ce8826c98565cf584
- MD5 acfaef5121fea0ffe722ee219de9d90f
- SHA1 95bca355071e6fb5b554dd7a30168759eb5d988b
- SHA512 5dcd5633f264fbe4d497ce6c3087de6aed53a2cfbca301bca8e567b1efaa6869fd99068588523005bfb4ee3b6aaa2672822845a7ea913a2f9c7f8b1b5cf42df0
- SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+aPIC:5Zv5PDwbjNrmAE+GIC
- TLSH T19D73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B
- MD5 SHA1 SHA512 SSDEEP TLSH