discordrat | d624951bfc5e38a018beb94c1c8acb97a6becca52e6d069b156b5e55608f857a | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 12:39

Sharing

Report Analysis Logs

General

Target

Onnx File Installer.exe
Size

78KB
MD5

e35f5c4a4d3763f1c9ea5ae6001c6ae4
SHA1

32869af3cae52873656cfc64f4c169151c2bdd7d
SHA256

2a470ef5fe5f825bf643a3d1fa819659857513a2c81cdc9a0305235617dc1b04
SHA512

8d3045ce0304c45a3be7a046940c6453c08386d5697e721161ac9f6cc5dfc68deecdbc5de94045153963e0810c486d9ceaa9e3229c60b7121cc85be57700645e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0MzM1NDI0NDI1NDI3MzYzNw.GUkt7C.Pcja3LSm_8Cp1CqJOlASW0-GzRtoJOOBBsmJcg
server_id
1232533200622845975

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3044	1932	Onnx File Installer.exe	28
PID 1932 wrote to memory of 3044	1932	Onnx File Installer.exe	28
PID 1932 wrote to memory of 3044	1932	Onnx File Installer.exe	28

C:\Users\Admin\AppData\Local\Temp\Onnx File Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Onnx File Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1932 -s 600
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-0-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

Filesize
4KB

Download
memory/1932-1-0x000000013F560000-0x000000013F578000-memory.dmp

Filesize
96KB

Download
memory/1932-2-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download
memory/1932-3-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download