discordrat | f895e12abca5b1c4bbd96166ff1900b55e6fb2537b664b39bb140628531e8f65 | Triage

Resubmissions

16-04-2024 18:26

240416-w3k35shc74 10

12-02-2024 02:31

240212-cztfkagh3s 10

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 02:31

Sharing

Report Analysis Logs

General

Target

dis.exe
Size

78KB
MD5

b6310ca2c49b28fbac28fef7a0877d18
SHA1

8451bac38ac99353f658e7b0042fe653d4292da0
SHA256

f895e12abca5b1c4bbd96166ff1900b55e6fb2537b664b39bb140628531e8f65
SHA512

ba01e5f1295552a78b0ce58f25f4019a1d374918ab6a187cd07c2715a965a1a0c6a71b22a39d52ad20efeda0fc5c790a5afd64ff648f77b0538219c6e0d42e6c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5ODg5OTYxNjc0MjEyNTYxOQ.GnQUlc.09G3jOrvsBUkj3tHkQPTbGic1sDnwN7xUFlV3o
server_id
1201324675507171409

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1892	1928	dis.exe	28
PID 1928 wrote to memory of 1892	1928	dis.exe	28
PID 1928 wrote to memory of 1892	1928	dis.exe	28

C:\Users\Admin\AppData\Local\Temp\dis.exe
"C:\Users\Admin\AppData\Local\Temp\dis.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1928 -s 596
  2⤵
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-0-0x000000013F130000-0x000000013F148000-memory.dmp

Filesize
96KB

Download
memory/1928-1-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/1928-2-0x000000001B9D0000-0x000000001BA50000-memory.dmp

Filesize
512KB

Download