discordrat | d01b49ea8c4f9215e0838147fb4eb5909c6298e9f1314e7401faf0d6cbc5d9e0

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

reducer.exe
Size

29KB
MD5

113b4c92dca5eb03fef7916d9d3216be
SHA1

231a7949ef5eb2fadf148884742b40d32e71cdd7
SHA256

d01b49ea8c4f9215e0838147fb4eb5909c6298e9f1314e7401faf0d6cbc5d9e0
SHA512

fe348660ff1d08b937178466852c04042db6fa0ceda6981c7cdff726e6629741d1170bfee6be16c115a9df1d2a3177b985ade216a137d2f6f83fbd2ab199cd10
SSDEEP

768:KMLDTH3XaAy8MM9cmtqTbUh/W2pfAIxsXo:PHiS9cIhe2pI3o

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTEyOTg3Mzk2MjY0MjQ2MDc3Mw.GVoB7q.zgQTyRC6__mUfWAQ71TKowd69RCw5b2gtOewvc
server_id
979482293682978877

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	reducer.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Reducer.exe	reducer.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	Reducer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
51	discord.com
24	raw.githubusercontent.com
39	discord.com
40	discord.com
78	discord.com
79	discord.com
25	raw.githubusercontent.com
70	discord.com
71	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	Reducer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2096	1132	reducer.exe	103
PID 1132 wrote to memory of 2096	1132	reducer.exe	103
PID 1132 wrote to memory of 3260	1132	reducer.exe	104
PID 1132 wrote to memory of 3260	1132	reducer.exe	104

C:\Users\Admin\AppData\Local\Temp\reducer.exe
"C:\Users\Admin\AppData\Local\Temp\reducer.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\DriverFolder\Reducer.exe
  "C:\Users\Admin\AppData\Local\Temp\DriverFolder\Reducer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DriverFolder\Reducer.exe

Filesize
78KB

MD5
a0ed18c4c55e30f18daea0a73d7fbaf2

SHA1
a1fcf1341639f9866dbf6e5a159f189f1daa83b4

SHA256
a9e915cdf40d63a220b00b2391859d240969293bb489d2c78b55273079793a15

SHA512
034691a5765e9b601a18fc385c783ac5083b13f2bc84500adbab799eca2013467f0eaf23a87222113649a43488e890430491124de994569ab7f441b12640e070

Download Submit
memory/2096-27-0x00000215F2830000-0x00000215F2848000-memory.dmp

Filesize
96KB

Download
memory/2096-31-0x00000215F4EA0000-0x00000215F5062000-memory.dmp

Filesize
1.8MB

Download
memory/2096-32-0x00007FF9836D0000-0x00007FF984191000-memory.dmp

Filesize
10.8MB

Download
memory/2096-33-0x00000215F44B0000-0x00000215F44C0000-memory.dmp

Filesize
64KB

Download
memory/2096-34-0x00000215F6320000-0x00000215F6848000-memory.dmp

Filesize
5.2MB

Download
memory/2096-35-0x00007FF9836D0000-0x00007FF984191000-memory.dmp

Filesize
10.8MB

Download
memory/2096-36-0x00000215F44B0000-0x00000215F44C0000-memory.dmp

Filesize
64KB

Download
memory/2096-38-0x00007FF9836D0000-0x00007FF984191000-memory.dmp

Filesize
10.8MB

Download