discordrat | 4f2be08bc6395869cfb71741c4803ce5e8b68fd365bd1d7fe98a7aacee767ae1 | Triage

Resubmissions

23-04-2024 02:21

240423-cs8a5sbe89 10

23-04-2024 02:15

240423-cpn34abe65 10

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 02:21

Sharing

Report Analysis Logs

General

Target

XPsycho Cheats.exe
Size

78KB
MD5

acfe98b80f2cc1929151b81428ce26bf
SHA1

3d221a1850320f3a7f996778d5625b6e6fa24f40
SHA256

4f2be08bc6395869cfb71741c4803ce5e8b68fd365bd1d7fe98a7aacee767ae1
SHA512

8f1452f4111f77038048fb3c747fcc9133594e1929c396863b22f36e2aa7bf3aa6e80c8ccafa39f95fe7e90dc5fc031e00b222b548b44c3e3757ccec6f2ac8ba
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzMjE0OTc3MzQ5NTMwNDMwNA.Gkp4-u.iV4nsscSdQyxBohbfKg-cwo6OGwImN17S7r0x4
server_id
1232150214391890031

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2376	1444	XPsycho Cheats.exe	28
PID 1444 wrote to memory of 2376	1444	XPsycho Cheats.exe	28
PID 1444 wrote to memory of 2376	1444	XPsycho Cheats.exe	28

C:\Users\Admin\AppData\Local\Temp\XPsycho Cheats.exe
"C:\Users\Admin\AppData\Local\Temp\XPsycho Cheats.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1444 -s 596
  2⤵
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-0-0x000000013F250000-0x000000013F268000-memory.dmp

Filesize
96KB

Download
memory/1444-1-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/1444-2-0x000000001B940000-0x000000001B9C0000-memory.dmp

Filesize
512KB

Download
memory/1444-3-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download