discordrat | 97ffdc85eaf253b0bf73ff4c7218ba69c633163d68a8c81b1cca26d37413a2ec | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 00:57

Sharing

Report Analysis Logs

General

Target

NEXO OSINT TOOLS.exe
Size

78KB
MD5

26bbb735944110bb972f756f4ddf3043
SHA1

dc4b9bc259eae6e2844f544eccc77d25b55643b6
SHA256

97ffdc85eaf253b0bf73ff4c7218ba69c633163d68a8c81b1cca26d37413a2ec
SHA512

3f95f8606a340c3998cc28c136af6b700976328f66d21f8159baca1258978e9ce8d6568c1796ae2a5067b9a66c5134640c759e737ee2e77505fcad7873dde513
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+PPIC:5Zv5PDwbjNrmAE+3IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyNTU4MTkxODM5ODE4NTQ5NA.Gw9CZ8.yYe5hL8D8XiPvhntF1xwye-frottc7F_HntHW0
server_id
1222772434135158806

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2032	928	NEXO OSINT TOOLS.exe	28
PID 928 wrote to memory of 2032	928	NEXO OSINT TOOLS.exe	28
PID 928 wrote to memory of 2032	928	NEXO OSINT TOOLS.exe	28

C:\Users\Admin\AppData\Local\Temp\NEXO OSINT TOOLS.exe
"C:\Users\Admin\AppData\Local\Temp\NEXO OSINT TOOLS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 928 -s 600
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-0-0x000000013F370000-0x000000013F388000-memory.dmp

Filesize
96KB

Download
memory/928-1-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

Filesize
9.9MB

Download
memory/928-2-0x000000001B9D0000-0x000000001BA50000-memory.dmp

Filesize
512KB

Download
memory/928-3-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

Filesize
9.9MB

Download