discordrat | d56a1643d296616d07291a85c65b5af1189c3f7ac5197534556a168e20c326a4

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loader.exe
Size

78KB
MD5

0fe5eef86f55a197b86a758915f11059
SHA1

2eff191d8f447d999d427fd825a266ab7a0b358e
SHA256

d56a1643d296616d07291a85c65b5af1189c3f7ac5197534556a168e20c326a4
SHA512

7b657babe30b904f48559d5597501dee92b61cc70955008a1007a9e480ddc9cca5d4b2ff1d1ffabc095dfb13478e307519a9f4a276a4bf45eb6b42abf409b23f
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+aPIC:5Zv5PDwbjNrmAE+GIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0MjA5MzEzMDI2NjgzNzA0Mw.GPiHV0.xzmGeKlEDKXpKijmlwzstJzxgKPWKJkSa-fjRA
server_id
1242093566004822039

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

40 discord.com
6 discord.com
21 discord.com
30 discord.com
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

loader.exe

description pid process

Token: SeDebugPrivilege 400 loader.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

loader.exe

description pid process target process

PID 400 wrote to memory of 1452 400 loader.exe SCHTASKS.exe
PID 400 wrote to memory of 1452 400 loader.exe SCHTASKS.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

flow	ioc
40	discord.com
6	discord.com
21	discord.com
30	discord.com

description	pid	process
Token: SeDebugPrivilege	400	loader.exe

description	pid	process	target process
PID 400 wrote to memory of 1452	400	loader.exe	SCHTASKS.exe
PID 400 wrote to memory of 1452	400	loader.exe	SCHTASKS.exe

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\SYSTEM32\SCHTASKS.exe
"SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
2⤵
PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-0-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Filesize
8KB

Download
memory/400-1-0x000001F9EACC0000-0x000001F9EACD8000-memory.dmp

Filesize
96KB

Download
memory/400-2-0x000001F9ED390000-0x000001F9ED552000-memory.dmp

Filesize
1.8MB

Download
memory/400-3-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/400-4-0x000001F9EDB90000-0x000001F9EE0B8000-memory.dmp

Filesize
5.2MB

Download
memory/400-5-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Filesize
8KB

Download
memory/400-6-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download