discordrat | ac41c286ebf5334f779673be26eeef81e2ff616e07deebc7a276cc6532469526 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 09:06

Sharing

Report Analysis Logs

General

Target

Info_2.0.exe
Size

78KB
MD5

a09754aaa72c6a22ab68b2dd55b2f6b5
SHA1

3ad597a0417a80981aefef93eab0edf63ecb3e48
SHA256

ac41c286ebf5334f779673be26eeef81e2ff616e07deebc7a276cc6532469526
SHA512

282fdb6891475203b436c35b0eda5602a9e8f8ec49335f88974ad9e959d5e2e24c7e117e3d614fc79b62e626e3d0a43899d0fe2b6ea24498372567257f5d3e9f
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMDgxNTkxMzcyNTc5NjM4Mw.G2d-ZZ.T2zCaZmaKz1r96SYjQQqYMgSkg3tF-oAtGYh1M
server_id
1210816339246194798

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2172	2904	Info_2.0.exe	28
PID 2904 wrote to memory of 2172	2904	Info_2.0.exe	28
PID 2904 wrote to memory of 2172	2904	Info_2.0.exe	28

C:\Users\Admin\AppData\Local\Temp\Info_2.0.exe
"C:\Users\Admin\AppData\Local\Temp\Info_2.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2904 -s 596
  2⤵
  PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2904-0-0x000000013FD10000-0x000000013FD28000-memory.dmp

Filesize
96KB

Download
memory/2904-1-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2904-2-0x000000001B9D0000-0x000000001BA50000-memory.dmp

Filesize
512KB

Download
memory/2904-3-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download