discordrat | bc8e1459074ad73a45d919a4be28396d3c12bb22bc0c05dc82cb502fa888e01d | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

a9b0036b5a427a71f462b9983ec3ed08
SHA1

3c7e7edc8f67e0d75c2ed9103e4b9aa00e9f6bdb
SHA256

bc8e1459074ad73a45d919a4be28396d3c12bb22bc0c05dc82cb502fa888e01d
SHA512

bc94330727e48a114f6d9caa1d21973a3840360beed5a61a8da648a30c562b3c9479fc05ce68fdcb0f0799234e4f74e008efc1cac591970cbc37e95541d70f34
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMDY4MTk1NTQyNzk1MDY4Mg.Gy5dHF.usUl_OuFhHY1gNEyIwlH2QhBUK8j2WHU94qm9Q
server_id
1210681778017144962

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2888	2740	Client-built.exe	28
PID 2740 wrote to memory of 2888	2740	Client-built.exe	28
PID 2740 wrote to memory of 2888	2740	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 596
  2⤵
  PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-0-0x000000013F3A0000-0x000000013F3B8000-memory.dmp

Filesize
96KB

Download
memory/2740-1-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2740-2-0x000000001B910000-0x000000001B990000-memory.dmp

Filesize
512KB

Download
memory/2740-3-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download