discordrat | 83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead

Analysis

max time kernel
147s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead.exe
Size

490KB
MD5

4f66d83ac5cd767b5d651fc7303e031d
SHA1

2de6b6dcc979bed6905ea3d9514f6599c2cf2184
SHA256

83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead
SHA512

ee66b6f5024d57965d96a4420e15d7aef133005d4aaca254bc6ab0796174a9114c9180f5eb098486ed940c32306cfbe361af156cfa75f9d9f1145807240617fd
SSDEEP

12288:pToPWBv/cpGrU3yyK2ToKLk7xCh6Wjgnu:pTbBv5rUVjTouk7xQ6Wjgu

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyOTQxMzUwMjU5MTE3NjcyNg.G9KrjP.D-XUbbPM5RZnvYvC1sooWa_RQE0mmSjhRciaaA
server_id
1229419379473649684

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead.exe

Executes dropped EXE 1 IoCs

pid	Process
2376	merce.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
18	discord.com
22	discord.com
37	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	merce.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2376	4672	83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead.exe	92
PID 4672 wrote to memory of 2376	4672	83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead.exe	92

C:\Users\Admin\AppData\Local\Temp\83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead.exe
"C:\Users\Admin\AppData\Local\Temp\83ff41f5ac07fcd96bcfe6cea3b585e9d13ad81f35ffac0c2f10a3a891e71ead.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\merce.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\merce.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\merce.exe

Filesize
78KB

MD5
f8b727e03011ec307476de3618e710c8

SHA1
cafcdc4c41380e10846c0aa94edae219181498dc

SHA256
6174e2ead9888152eff065d77adabf5418bda3d3de15f2b7232ea96e0bdf5a4d

SHA512
380ae6d6391179b1ebfab6cd357056f4b042c53726a4da5891aa33e431cea6f26fa80d6b2bced10bf1bcaaf39be02302526ad44a4ecc00346b4f3c525bddeebb

Download Submit
memory/2376-14-0x0000027B8CE60000-0x0000027B8CE78000-memory.dmp

Filesize
96KB

Download
memory/2376-15-0x0000027BA73E0000-0x0000027BA75A2000-memory.dmp

Filesize
1.8MB

Download
memory/2376-16-0x00007FF9466F0000-0x00007FF9471B1000-memory.dmp

Filesize
10.8MB

Download
memory/2376-17-0x0000027B8EB70000-0x0000027B8EB80000-memory.dmp

Filesize
64KB

Download
memory/2376-18-0x0000027BA7BE0000-0x0000027BA8108000-memory.dmp

Filesize
5.2MB

Download
memory/2376-19-0x00007FF9466F0000-0x00007FF9471B1000-memory.dmp

Filesize
10.8MB

Download
memory/2376-20-0x0000027B8EB70000-0x0000027B8EB80000-memory.dmp

Filesize
64KB

Download