discordrat | bd4df19e87a261554c78c692db80409c9f2199cc12f145a27bc53724deb86e8d | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 04:06

Sharing

Report Analysis Logs

General

Target

test.exe
Size

78KB
MD5

fc6b651ea1ddd4ac10fb1d6ef95f562c
SHA1

663052abcc17a56b8cddefb7eb05fec78961d1b8
SHA256

bd4df19e87a261554c78c692db80409c9f2199cc12f145a27bc53724deb86e8d
SHA512

fdb7820e33d2ae444650dd5e6573ed1670fe51bd2dabb2e27d33d1729df00044f470985577eb151a9ddef4073610c829acf91b173703740d3e95ce4b8cc846ab
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5NDY1NzI3NjUzMTgzOTA2OA.GERX8w.MH9nspL8ovXENHj8L8dbf5GkDr18cWQ5AkbcEM
server_id
1220171620380049438

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2600	2208	test.exe	28
PID 2208 wrote to memory of 2600	2208	test.exe	28
PID 2208 wrote to memory of 2600	2208	test.exe	28

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2208 -s 596
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x000000013F0D0000-0x000000013F0E8000-memory.dmp

Filesize
96KB

Download
memory/2208-1-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download
memory/2208-2-0x000000001BA40000-0x000000001BAC0000-memory.dmp

Filesize
512KB

Download
memory/2208-3-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download