discordrat | 5287600ca39b26305bbf196aba9dfcf07f28c506378cd488ccc9cfe604ca88fa | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 16:41

Sharing

Report Analysis Logs

General

Target

NexifySpoofer.exe
Size

78KB
MD5

4ef0d6a371e458267b016507b7e188ab
SHA1

031fa13b2796e5e47603de1568cd95d62beec580
SHA256

5287600ca39b26305bbf196aba9dfcf07f28c506378cd488ccc9cfe604ca88fa
SHA512

b5edd3f60dc5c2be770cc3060c52b8a6b4b454ea071abc9e7de6e24eacb1d95322474ba2884829197f280bae412df7d37c541517320e802648738f9556b16fb3
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyNTExMjM3NDg0ODI1ODE1MQ.GD7Lg9.DVktuSzK2JzS6dRXiqXqY96EK_3TtmqaSVcQhI
server_id
1225115386102550651

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2136	2704	NexifySpoofer.exe	28
PID 2704 wrote to memory of 2136	2704	NexifySpoofer.exe	28
PID 2704 wrote to memory of 2136	2704	NexifySpoofer.exe	28

C:\Users\Admin\AppData\Local\Temp\NexifySpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\NexifySpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2704 -s 596
  2⤵
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-0-0x000000013F050000-0x000000013F068000-memory.dmp

Filesize
96KB

Download
memory/2704-1-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-2-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/2704-3-0x000007FEF5470000-0x000007FEF5E5C000-memory.dmp

Filesize
9.9MB

Download