discordrat | aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134 | Triage

Resubmissions

31-05-2024 20:14

240531-y1gn2sbg5s 10

31-05-2024 20:12

240531-yy9l2sbf9t 10

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 20:12

Sharing

Report Analysis Logs

General

Target

monoware.exe
Size

78KB
MD5

8da8b05938831e8e547b60526236ece7
SHA1

c27806eed416f8676548d89aa0207d028f800234
SHA256

aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134
SHA512

552e09c36ec48d3117209546e70b1322b929d3f5c59f49af4e66f51c5123230bec766a7315de022027afc0d41920fa7f86f42d82e4f000ac73bab08136221ec6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NjE3NzQ1MDg3OTA5MDY5OA.GQYQs_.CWWy01exlwJSA5-Ryb8HsR5UWeE5uOF58bPcZs
server_id
1243377281129254984

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 948	1736	monoware.exe	28
PID 1736 wrote to memory of 948	1736	monoware.exe	28
PID 1736 wrote to memory of 948	1736	monoware.exe	28

C:\Users\Admin\AppData\Local\Temp\monoware.exe
"C:\Users\Admin\AppData\Local\Temp\monoware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 596
  2⤵
  PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-0-0x000007FEF5B83000-0x000007FEF5B84000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x000000013FEF0000-0x000000013FF08000-memory.dmp

Filesize
96KB

Download
memory/1736-2-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/1736-3-0x000007FEF5B83000-0x000007FEF5B84000-memory.dmp

Filesize
4KB

Download