discordrat | 830ea2fb5b31f1579ad9d59940c0a9895fc6c8ceec5c45c5f2604f7e4a5227ad

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoMowA.exe
Size

78KB
MD5

2134f0cbed3a8398034cb78610a0ffe4
SHA1

966b3cb2ec2d3494f7aaffca9bad5559c6d4c320
SHA256

9e0574b31c5dc6356e84796082be6f7ff319bc43c57b24657d1e6930c863018a
SHA512

936d2282287b2ca788c82a6afbbe8d6733375c52ad70cff55e2798463e41706cf36de6bc71c74e8aca7f487f96b4ea918c3469500cc03f2fd446bea6cc85e346
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMzg1OTc0OTA5OTk5NTE1Ng.GrWby9.mJ91kTjDMlDqeg1nwJTmQUCJaPjtYk5eenqOnU
server_id
1213859181925240924

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
29	discord.com
30	discord.com
34	discord.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	MoMowA.exe

C:\Users\Admin\AppData\Local\Temp\MoMowA.exe
"C:\Users\Admin\AppData\Local\Temp\MoMowA.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4560-0-0x000002B64B940000-0x000002B64B958000-memory.dmp

Filesize
96KB

Download
memory/4560-1-0x000002B665F20000-0x000002B6660E2000-memory.dmp

Filesize
1.8MB

Download
memory/4560-3-0x000002B665E20000-0x000002B665E30000-memory.dmp

Filesize
64KB

Download
memory/4560-2-0x00007FFFA4C80000-0x00007FFFA5741000-memory.dmp

Filesize
10.8MB

Download
memory/4560-4-0x000002B667110000-0x000002B667638000-memory.dmp

Filesize
5.2MB

Download
memory/4560-5-0x00007FFFA4C80000-0x00007FFFA5741000-memory.dmp

Filesize
10.8MB

Download
memory/4560-6-0x000002B665E20000-0x000002B665E30000-memory.dmp

Filesize
64KB

Download