discordrat | 25981c5a22378707acf5960d2aa40a50516a1dcb9ea82dfdc1bb2067f6811bac

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Exploiter/Exploiter‮‮.exe
Size

447KB
MD5

1f45fbe95cf28a77d25bf115cc3002fe
SHA1

c1483030959bb50c1a3875b8202852bffee0913c
SHA256

514e6cb42b3b1431e89a415af7d0a98e51e4239be0c085a1730c996eef71cd9d
SHA512

f58574dd9efdf44bdb81adb3e6c1381a59c9afd1c7486359a8efb310e6d0e94511770288ac47cbafa80e2cb3467cb57e0c7a7e9fecc1e012dd643cf79df5d5b4
SSDEEP

12288:XCQjgAtAHM+vetZxF5EWry8AJGy0x4xLe4:X5ZWs+OZVEWry8AFtxe4

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzNjMwNTc2MjU5NTI0MjA1NQ.G6VLak.4vdqf2Zl4iPZ7e-AyK9ykkGmr9LZPBhhchrbdY
server_id
1236306342461964380

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
2664	Exploiter.exe

Loads dropped DLL 6 IoCs

pid	Process
2168	Exploiter‮‮.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe
2968	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2664	2168	Exploiter‮‮.exe	29
PID 2168 wrote to memory of 2664	2168	Exploiter‮‮.exe	29
PID 2168 wrote to memory of 2664	2168	Exploiter‮‮.exe	29
PID 2664 wrote to memory of 2968	2664	Exploiter.exe	30
PID 2664 wrote to memory of 2968	2664	Exploiter.exe	30
PID 2664 wrote to memory of 2968	2664	Exploiter.exe	30

C:\Users\Admin\AppData\Local\Temp\Exploiter\Exploiter‮‮.exe
"C:\Users\Admin\AppData\Local\Temp\Exploiter\Exploiter‮‮.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Exploiter.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Exploiter.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2664 -s 596
    3⤵
    - Loads dropped DLL
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\Exploiter.exe

Filesize
78KB

MD5
78c524f335315f9a5d39c4f129431801

SHA1
98b113cbbca0b1a0fd500f2ebc05fa7456c46b2d

SHA256
3d44765f108d3a39af671642d57da473b66c668830e0cd1488478c749fb47520

SHA512
c7e304ba344ad96fde2782fa232a30f92cb4c638153282ed5d0adc3c1d26a8331dca4d7737b79c3fafbc73cb5524b9282f063c852458d8a81e5c681eb90dcc12

Download Submit
memory/2168-4-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/2664-11-0x000007FEF5633000-0x000007FEF5634000-memory.dmp

Filesize
4KB

Download
memory/2664-12-0x000000013FCD0000-0x000000013FCE8000-memory.dmp

Filesize
96KB

Download
memory/2664-17-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-19-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download