discordrat | a67b2fd43da9e0f72570f3c2d40e3b08e5f42eb9bce5353b21fba6c6b09cc0e8 | Triage

Analysis

max time kernel
42s
max time network
19s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 06:21

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

aea05da2a4bdde3c2b978e952d43e10d
SHA1

63365323d025823d9c62f9e90992586be9958b55
SHA256

a67b2fd43da9e0f72570f3c2d40e3b08e5f42eb9bce5353b21fba6c6b09cc0e8
SHA512

afd1114e3a140197a5f0cd917567f13c38979fe01daf45028a8e6cfe070c292d092f1d2f116fb514406209600708ea380dbcfd762ce4995678e01060d5fdbc7e
SSDEEP

1536:p2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+WPIC:pZb5PDwbjNrmAE+SIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyNDIzODgzODg2NDY3OTAyMg.GPt9dC.Izlu2VmzrS6Z0RCqmiNwPpfNHWESmy3TYCCrTc
server_id
https://discord.com/channels/1154633271540461648/1154633271985045566

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1748	2124	Client-built.exe	28
PID 2124 wrote to memory of 1748	2124	Client-built.exe	28
PID 2124 wrote to memory of 1748	2124	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 596
  2⤵
  PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x000000013FFF0000-0x0000000140008000-memory.dmp

Filesize
96KB

Download
memory/2124-1-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-2-0x000000001B9D0000-0x000000001BA50000-memory.dmp

Filesize
512KB

Download
memory/2124-3-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

Filesize
9.9MB

Download