discordrat | 393d1b3a08e430009ac255bb1b69a9e89f2b3941bf0f6c3350c573ef6a2a4781 | Triage

Analysis

max time kernel
839s
max time network
840s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 09:20

Sharing

Report Analysis Logs

General

Target

rename it to anything u want.exe
Size

78KB
MD5

48e19854f39efd67557230f8fd774e59
SHA1

5aa8cea7fb5546e04edd2ae8102e4eb57d49ad7e
SHA256

393d1b3a08e430009ac255bb1b69a9e89f2b3941bf0f6c3350c573ef6a2a4781
SHA512

1ac56b9b1f48da73bc4fa9b25c911681edce7712035ba1f08bbc23cb43b6689d7f1f462f557c78c906c022c3ffccdbcb9e09c8f5285a7cf77b02d89d9feef552
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+tPIC:5Zv5PDwbjNrmAE+9IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMTA5OTM2NzcyMTc5NTYzNA.GpJZAn.XKPX_MM37tG_lVoxdQYnShiSH6ZYr3HZsqXqKw
server_id
1211092147235987486

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2928	2868	rename it to anything u want.exe	28
PID 2868 wrote to memory of 2928	2868	rename it to anything u want.exe	28
PID 2868 wrote to memory of 2928	2868	rename it to anything u want.exe	28

C:\Users\Admin\AppData\Local\Temp\rename it to anything u want.exe
"C:\Users\Admin\AppData\Local\Temp\rename it to anything u want.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2868 -s 596
  2⤵
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-0-0x000000013F440000-0x000000013F458000-memory.dmp

Filesize
96KB

Download
memory/2868-1-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2868-2-0x000000001B800000-0x000000001B880000-memory.dmp

Filesize
512KB

Download
memory/2868-3-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download