discordrat | 067e6715c37629155ae95e4896d31ca4d9389179482cd0b18fc1043b4e99d70b

Analysis

max time kernel
300s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

302KB
MD5

ee6160c1a4a92c9660402f147b560431
SHA1

045c5019a2557de570a7ffc0270d4b4939bbf855
SHA256

55897406bcc2b5c3ba05b57e97bbc69a2eb5a2941b90a2982e2d3c89d57fbfb9
SHA512

64189d777a33eedbac2979af87e196e099565b0ca53f842c74bf2826d3c11a1aeaed82823e9089ac8e28e8b0075f6333e64062c6e92ff2696ffd4b88d29ea811
SSDEEP

6144:vCGaECnpAoDO1A8dg3iTPJLMfgQZycxF+Ii:6GHCnaomAEg3uPdkgWycxF+t

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMDQ1NjY0ODQ1MjQxNTUwOA.Gh0y7q.0U1kmcgYc3Agu4PPdar0sgV_bW8X8ZoS9NlBm8
server_id
1210454330054807572

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	[email protected]

Executes dropped EXE 1 IoCs

pid	Process
3444	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	[email protected]

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3444	5084	[email protected]	88
PID 5084 wrote to memory of 3444	5084	[email protected]	88

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
78KB

MD5
16d5a3ec9eb1dab4643ec0337b8d9a0f

SHA1
71e5fce8d3b87f85c1de40e785ffaf15fbf49c43

SHA256
335aa65392bdd960f15fa587ebe629e9a6f42f8ee1b7e7a7f77ef6dd967b6c9a

SHA512
57a9347363e218d19d616b63d45bb3cc0bdd482cd5191622fa753a73bdaa9ddf341cd9d274501062bba8aff68590eebe29313c1d5e4c116b18ddcefa24923704

Download Submit
memory/3444-14-0x000002527E3B0000-0x000002527E3C8000-memory.dmp

Filesize
96KB

Download
memory/3444-15-0x000002527F630000-0x000002527F7F2000-memory.dmp

Filesize
1.8MB

Download
memory/3444-16-0x00007FFA77140000-0x00007FFA77C01000-memory.dmp

Filesize
10.8MB

Download
memory/3444-17-0x000002527F530000-0x000002527F540000-memory.dmp

Filesize
64KB

Download
memory/3444-18-0x00007FFA77140000-0x00007FFA77C01000-memory.dmp

Filesize
10.8MB

Download