discordrat | 939fed83d6381ce90f7e69833204f77be7134c62b0fef6f2d8e82722b1a30e9c | Triage

Submit
Reports

Overview

overview

Static

static

3

check_pic.exe

windows10-2004-x64

Resubmissions

18-04-2024 16:03

240418-thdr8ahc53 10

17-04-2024 17:38

240417-v7pfpaab9w 10

Analysis

max time kernel
3s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 16:03

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

check_pic.exe

Resource

win10v2004-20240226-en

discordrat persistence rat rootkit stealer

windows10-2004-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target

check_pic.exe
Size

91KB
MD5

2a6bcd471e17bf7e517ed75b3f96dfd9
SHA1

2a1318834be42e05de6c1a466958ce475b1bbb58
SHA256

939fed83d6381ce90f7e69833204f77be7134c62b0fef6f2d8e82722b1a30e9c
SHA512

f10bc9f91b0c3b497bb1aea79022948d56979f04f86d3992066ade731a776246231c93c1045a57c70514ddd1f3e0d87d9ec88f166f180667adac8f7c2619099c
SSDEEP

1536:IJs1RO8f2UsgLCerU8FlgksixIgmRx4QMWHzDb7+xbrBFeh1U+f5RzsrN:71QW2CJfj4iSgmRyQVDXgbNFn+f5psN

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwNzQ0Mjc2MTY3MDk4Nzg5Nw.G7QGsq.mV9vPnqHSKpUueDX1U0MR64-D5ZHLEHM-uK5fI
server_id
1228104284198015068

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Processes

C:\Users\Admin\AppData\Local\Temp\check_pic.exe
"C:\Users\Admin\AppData\Local\Temp\check_pic.exe"
1⤵
PID:948
- C:\Users\Admin\AppData\Local\Temp\check_ip.exe
  "C:\Users\Admin\AppData\Local\Temp\check_ip.exe"
  2⤵
  PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\check_ip.exe

Filesize
78KB

MD5
1ffb65a70c60aeb329faa730bf27ec08

SHA1
f0801acbb4d7c22650b6858c1385e4dfe4c8eb5b

SHA256
7633848cbdce6f2415f291f24e3c1773c3523ebeb2548a2dc4fd6c9bd6188ed0

SHA512
c7c5a9f84d6bc93cec18c849fab3e817365aff4540c97c2fc547d9d2c4e4d3b72263bafd46c93c721683fd7e071ddf94054f9a9f3008b26a003db39bb8ce2c60

Download Submit
memory/948-0-0x0000000000FC0000-0x0000000000FDE000-memory.dmp

Filesize
120KB

Download
memory/948-1-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/948-14-0x000000001BC30000-0x000000001BDD9000-memory.dmp

Filesize
1.7MB

Download
memory/948-18-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/4744-15-0x000002275F830000-0x000002275F848000-memory.dmp

Filesize
96KB

Download
memory/4744-17-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/4744-16-0x0000022779F90000-0x000002277A152000-memory.dmp

Filesize
1.8MB

Download
memory/4744-19-0x0000022779F40000-0x0000022779F50000-memory.dmp

Filesize
64KB

Download
memory/4744-20-0x000002277B040000-0x000002277B568000-memory.dmp

Filesize
5.2MB

Download
memory/4744-21-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/4744-22-0x0000022779F40000-0x0000022779F50000-memory.dmp

Filesize
64KB

Download

© 2018-2025

Terms | Privacy