discordrat | 9f20ab32cfec115c1079563a1f3d447d75da4035820f9232b7d543eb8dfa7156 | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 23:30

Sharing

Report Analysis Logs

General

Target

Adobe After Effects 2024 Loader.exe
Size

78KB
MD5

808e8843edbdb751f81d0f8b3cbadc06
SHA1

8aad16da21c5baef2a4484f58a8a6e101949a097
SHA256

9f20ab32cfec115c1079563a1f3d447d75da4035820f9232b7d543eb8dfa7156
SHA512

535e26dce1c9e81319d24a8fb9c03808af79a9e403cb15a6dff0e87c188dc045d6386914841261ab378b21dd622a6fbd3993d88edeebb961f86d1dc1f7dfab1c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+mPIC:5Zv5PDwbjNrmAE+CIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyOTkzMzQ1Njc2NzU4NjMxNQ.GA8lvX.p2sO85UW28jqHfp9V6UnNZYpTZjcyonJ3PZ21I
server_id
1211176359427313724

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2108	2836	Adobe After Effects 2024 Loader.exe	28
PID 2836 wrote to memory of 2108	2836	Adobe After Effects 2024 Loader.exe	28
PID 2836 wrote to memory of 2108	2836	Adobe After Effects 2024 Loader.exe	28

C:\Users\Admin\AppData\Local\Temp\Adobe After Effects 2024 Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Adobe After Effects 2024 Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2836 -s 600
  2⤵
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-0-0x000000013FCF0000-0x000000013FD08000-memory.dmp

Filesize
96KB

Download
memory/2836-1-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-2-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download
memory/2836-3-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download