discordrat | aa3727520be4bc19a78da7f575a9dcc93c0b5c2743725300f942e7dee2eaa3b1 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 11:31

Sharing

Report Analysis Logs

General

Target

test.exe
Size

78KB
MD5

ae9c47b621a083a0b0681b7aa9530946
SHA1

6cdd316cb5b2869927b42597b25cf7d495d5f9a4
SHA256

aa3727520be4bc19a78da7f575a9dcc93c0b5c2743725300f942e7dee2eaa3b1
SHA512

ae6330429bb9bc21709162296de375a79f5b8b89b3f4b58a5da12737b2fe0b44570e5eaab8fbb92ce190600fb1fc2a5f91fa425a719d8363a481d99f173bb109
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WYPIC:5Zv5PDwbjNrmAE+W8IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0MDA4ODk5MTQwODE5MzYyOA.GRW5NI.uFPBjoMjH0IQ-FgxpiJSv246Xes3LsI1_5H1Y8
server_id
1239434854953648229

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2992	2136	test.exe	28
PID 2136 wrote to memory of 2992	2136	test.exe	28
PID 2136 wrote to memory of 2992	2136	test.exe	28

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 596
  2⤵
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-0-0x000007FEF61B3000-0x000007FEF61B4000-memory.dmp

Filesize
4KB

Download
memory/2136-1-0x000000013F3F0000-0x000000013F408000-memory.dmp

Filesize
96KB

Download
memory/2136-2-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-3-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download