discordrat | 47680c12b9b928ff642864694790d799cd419668c4c96bdb58b1ae2818dbb574 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

hehegnp.scr

windows11-21h2-x64

Resubmissions

03/01/2024, 08:44

240103-knm4eacdcm 3

03/01/2024, 08:42

240103-kl956afaf7 10

03/01/2024, 08:35

240103-khc19acdbm 10

Analysis

max time kernel
5s
max time network
44s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
03/01/2024, 08:35

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

hehegnp.scr

Resource

win11-20231215-en

discordrat persistence rat rootkit stealer

windows11-21h2-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

hehegnp.scr
Size

1.3MB
MD5

a34f34fb4c3b4c36b3b81f97cdcb7ca3
SHA1

b56023dc51011bec0e91e54c9729f6e633a08867
SHA256

47680c12b9b928ff642864694790d799cd419668c4c96bdb58b1ae2818dbb574
SHA512

dfda79a26f6e419b07920efc27e5b8c40de4ca2a2d839c675c99cc8eb9bbb2b98b80729ecf36e3ef7fa247b41f51e8193e6cd874fe08418272a50d34d9a95cce
SSDEEP

24576:BNA3R5drX46t/YOd4prFamZa3wtdnJJ9NHuFkZhSq/JvU21wVcj2F76aP2GZ39wf:k546dbChJg3wtxz99ueZhSqtU2eVm2J0

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5MTk5ODM3NTg4OTk5Mzc4MA.G8Z16P.3jjREwtvwZBkdqbzBAXhIsaJmyZEYrq_haoKWM
server_id
1060150467436499004

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Processes

C:\Users\Admin\AppData\Local\Temp\hehegnp.scr
"C:\Users\Admin\AppData\Local\Temp\hehegnp.scr" /S
1⤵
PID:2540
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\nitro.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\nitro.exe"
  2⤵
  PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\nitro.exe

Filesize
78KB

MD5
b276f6c9a652197f36c8ef95441b4840

SHA1
5ccfb78de6c40fce8145fa5725176d0c556d22a7

SHA256
7036bea5264e75b932fa942f337ad028e22bbd8e7bdfd9cad10241538aa07d60

SHA512
7c4ae8c8aab416a56974fcfba1bc09dd84a1c43a26bf5d74cbf667ea86827d2949006e74f9e16eba2a67a52af47e4972f7c2a5f681f407e0af6e67998aecf209

Download Submit
memory/1952-14-0x000001C5D9F60000-0x000001C5D9F78000-memory.dmp

Filesize
96KB

Download
memory/1952-15-0x000001C5F4680000-0x000001C5F4842000-memory.dmp

Filesize
1.8MB

Download
memory/1952-16-0x00007FFECCFB0000-0x00007FFECDA72000-memory.dmp

Filesize
10.8MB

Download
memory/1952-17-0x000001C5F45B0000-0x000001C5F45C0000-memory.dmp

Filesize
64KB

Download
memory/1952-18-0x000001C5F5950000-0x000001C5F5E78000-memory.dmp

Filesize
5.2MB

Download
memory/1952-19-0x00007FFECCFB0000-0x00007FFECDA72000-memory.dmp

Filesize
10.8MB

Download

© 2018-2025

Terms | Privacy