discordrat | 402d83a67acf9591aaf8dc4e62dcafc4dd10f3987cb7a175f0c288de77a86ad7 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 14:21

Sharing

Report Analysis Logs

General

Target

PyrusC2.exe
Size

78KB
MD5

27f969d17693c222cdd0494cb2a09f80
SHA1

d5425670f1d1d40fb04a2a1c72dc7572a748a67a
SHA256

402d83a67acf9591aaf8dc4e62dcafc4dd10f3987cb7a175f0c288de77a86ad7
SHA512

33e8e65940074c84f24697ee6cc2654289419f02ca481033bf3c369f26fe4f16c3990a822fe0842f3feb2febe4cb8c57d8e3d1acc63d4c560e54ebe0806a42df
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMzUwMTgyMzQxMTgyMjYzMg.G_3rn-.hlmdq27ziRAcKVZvZ9b7woSeSyqsovKDo0qouc
server_id
1200522482130632846

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1784	1812	PyrusC2.exe	28
PID 1812 wrote to memory of 1784	1812	PyrusC2.exe	28
PID 1812 wrote to memory of 1784	1812	PyrusC2.exe	28

C:\Users\Admin\AppData\Local\Temp\PyrusC2.exe
"C:\Users\Admin\AppData\Local\Temp\PyrusC2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1812 -s 596
  2⤵
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1812-0-0x000000013FB30000-0x000000013FB48000-memory.dmp

Filesize
96KB

Download
memory/1812-1-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1812-2-0x000000001B9D0000-0x000000001BA50000-memory.dmp

Filesize
512KB

Download
memory/1812-3-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download