discordrat | d0696ae3dfc83c80cdaf0bb50aa0b7ca04c362177c3bb12ab79a355d261c5465 | Triage

Resubmissions

23-05-2024 16:42

240523-t7qs3shd6s 10

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 16:42

Sharing

Report Analysis Logs

General

Target

SolaraBETA.exe
Size

164KB
MD5

ef3211af9aefd0a032cd9fbb3c46d1e2
SHA1

b6e09ec37c2e50aec3e186b4b80696bc5fbdc1ec
SHA256

d0696ae3dfc83c80cdaf0bb50aa0b7ca04c362177c3bb12ab79a355d261c5465
SHA512

fed323033bb2868183eb5770a6ddb1e745db93dca7d23245ad94c32fc7ce223289cad62e48a8674e38e810c52de9eef1993efae2100e13cde0f78d070b0578cd
SSDEEP

3072:2Zv5PDwbjNrmAE+4IjLdGgCvZuT75lTT3MJObhH:Wv5PDwbBrUIjLdvm27wJON

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5NTg0ODc1MjI0NjgyNTA1Mg.G4P4wp.zMWMnomJQlTXAmzFNKlIfb-ParaaB86MEq0gOY
server_id
1234555349349040179

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SolaraBETA.exe

description	pid	process	target process
PID 1856 wrote to memory of 2288	1856	SolaraBETA.exe	WerFault.exe
PID 1856 wrote to memory of 2288	1856	SolaraBETA.exe	WerFault.exe
PID 1856 wrote to memory of 2288	1856	SolaraBETA.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SolaraBETA.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBETA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1856 -s 600
2⤵
PID:2288

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-0-0x000007FEF5BA3000-0x000007FEF5BA4000-memory.dmp

Filesize
4KB

Download
memory/1856-1-0x000000013FBB0000-0x000000013FBDC000-memory.dmp

Filesize
176KB

Download
memory/1856-2-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/1856-3-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download