discordrat | a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157 | Triage

Resubmissions

Analysis

max time kernel
3s
max time network
0s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-04-2024 13:56

Sharing

Report Analysis Logs

General

Target

ChromeInstallerOnline.exe
Size

78KB
MD5

751f7cc03ddcb53a3fdf0e6cc0dba454
SHA1

b85002ea831819271705d7ba2bf7bd7328631a84
SHA256

a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157
SHA512

3b5b52c9a24d4bb22214af434fa8375a435b81a8e31339c5a4babb7f0d023690161e270dfba8a81cadebc0df67cb7b77b1ae63484eef80b56ff6df63a1ba761d
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5MTc1ODU0NTA3OTc3MTIyNw.G5YEgr.tBtpWfyWjUI8p35eCosfi_smEYeHFjgpOnusAY
server_id
1055840436356390962

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2108	1888	ChromeInstallerOnline.exe	28
PID 1888 wrote to memory of 2108	1888	ChromeInstallerOnline.exe	28
PID 1888 wrote to memory of 2108	1888	ChromeInstallerOnline.exe	28

C:\Users\Admin\AppData\Local\Temp\ChromeInstallerOnline.exe
"C:\Users\Admin\AppData\Local\Temp\ChromeInstallerOnline.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1888 -s 596
  2⤵
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x000000013F830000-0x000000013F848000-memory.dmp

Filesize
96KB

Download
memory/1888-1-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1888-2-0x000000001B7D0000-0x000000001B850000-memory.dmp

Filesize
512KB

Download
memory/1888-3-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download