discordrat | 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec

General

Target

AutoClickerV2.exe
Size

79KB
MD5

d13905e018eb965ded2e28ba0ab257b5
SHA1

6d7fe69566fddc69b33d698591c9a2c70d834858
SHA256

2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512

b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP

1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5116	POWERPNT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	AutoClickerV2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5116	POWERPNT.EXE
5116	POWERPNT.EXE

C:\Users\Admin\AppData\Local\Temp\AutoClickerV2.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClickerV2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\RestartWatch.ppsx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4900-0-0x000001B895830000-0x000001B895848000-memory.dmp

Filesize
96KB

Download
memory/4900-1-0x000001B8AFE50000-0x000001B8B0012000-memory.dmp

Filesize
1.8MB

Download
memory/4900-2-0x00007FFD5AB70000-0x00007FFD5B632000-memory.dmp

Filesize
10.8MB

Download
memory/4900-3-0x000001B8AFD60000-0x000001B8AFD70000-memory.dmp

Filesize
64KB

Download
memory/4900-4-0x000001B8B1220000-0x000001B8B1748000-memory.dmp

Filesize
5.2MB

Download
memory/4900-5-0x00007FFD5AB70000-0x00007FFD5B632000-memory.dmp

Filesize
10.8MB

Download
memory/4900-6-0x000001B8AFD60000-0x000001B8AFD70000-memory.dmp

Filesize
64KB

Download
memory/5116-7-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-9-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-8-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-11-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-13-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-12-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-10-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-15-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-14-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-16-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-17-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-19-0x00007FFD39080000-0x00007FFD39090000-memory.dmp

Filesize
64KB

Download
memory/5116-18-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-20-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-21-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-22-0x00007FFD39080000-0x00007FFD39090000-memory.dmp

Filesize
64KB

Download
memory/5116-23-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-24-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-26-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-25-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-27-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-28-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-29-0x00007FFD79FB0000-0x00007FFD7A06D000-memory.dmp

Filesize
756KB

Download
memory/5116-30-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-46-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-47-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-48-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-49-0x00007FFD3BA10000-0x00007FFD3BA20000-memory.dmp

Filesize
64KB

Download
memory/5116-50-0x00007FFD7B980000-0x00007FFD7BB89000-memory.dmp

Filesize
2.0MB

Download
memory/5116-51-0x00007FFD79FB0000-0x00007FFD7A06D000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads