discordrat | 52ab6102c24d59bcc88d6d5311e8f7404e69b17233ba995bbd162326782ac412

General

Target

Client-built.exe
Size

78KB
MD5

7c16d8d9eca7c5ea3c0919afce4a42a8
SHA1

db2d93ddef2d96fc687b11830781c54d549b7d3c
SHA256

52ab6102c24d59bcc88d6d5311e8f7404e69b17233ba995bbd162326782ac412
SHA512

4dd267a609ee31405d0353186ac2588afe760c401fe43d8958fa6c7a9ecbb65665ee120876f49a6760de1cd703791516f9ff7362a8355ac1b53f002a2af80312
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyNzU5OTczMjkwMjMzMDM3OQ.GGJ-EF.ITvPrvNzJvdqzhVFGBeM8xjGUkZMvbKmCPGwDw
server_id
1221811060135170099

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1936	WINWORD.EXE
1936	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	Client-built.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1936	WINWORD.EXE
1936	WINWORD.EXE
1936	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Opened.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-16-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-25-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-49-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-17-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-47-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-18-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-46-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-7-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-8-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-9-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-10-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-11-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-12-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-13-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-14-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-15-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-48-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-45-0x00007FFD86A50000-0x00007FFD86A60000-memory.dmp

Filesize
64KB

Download
memory/1936-29-0x00007FFD859C0000-0x00007FFD859D0000-memory.dmp

Filesize
64KB

Download
memory/1936-19-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-20-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-22-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-21-0x00007FFD859C0000-0x00007FFD859D0000-memory.dmp

Filesize
64KB

Download
memory/1936-23-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-24-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-28-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-26-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/1936-27-0x00007FFDC69D0000-0x00007FFDC6BC5000-memory.dmp

Filesize
2.0MB

Download
memory/3176-1-0x0000020F6ECF0000-0x0000020F6EEB2000-memory.dmp

Filesize
1.8MB

Download
memory/3176-5-0x00007FFDA7B00000-0x00007FFDA85C1000-memory.dmp

Filesize
10.8MB

Download
memory/3176-3-0x0000020F6EBB0000-0x0000020F6EBC0000-memory.dmp

Filesize
64KB

Download
memory/3176-6-0x0000020F6EBB0000-0x0000020F6EBC0000-memory.dmp

Filesize
64KB

Download
memory/3176-4-0x0000020F6F530000-0x0000020F6FA58000-memory.dmp

Filesize
5.2MB

Download
memory/3176-0-0x0000020F6C7B0000-0x0000020F6C7C8000-memory.dmp

Filesize
96KB

Download
memory/3176-2-0x00007FFDA7B00000-0x00007FFDA85C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads