discordrat | 56c4d335ac7734b3fcc93e70dc43216d571cfd52117ebda2dd5dae7d070a5d9c

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxAdminPanelNewLeakedgpj.exe
Size

376KB
MD5

211bd65a74765df0e85a8eedbc2e98c2
SHA1

d68318a9a00483d49f34d5a3573cf981308aa31f
SHA256

56c4d335ac7734b3fcc93e70dc43216d571cfd52117ebda2dd5dae7d070a5d9c
SHA512

0ef222608495c1eefb4a786663542c73c9c3a5160e7b73e678a0bdbea9824985ab4bd4d3f64fa0cb8a71b89c7e07f378a45851d79318b6f523f41fa61a58ebc7
SSDEEP

6144:PE+yclwQKjdn+WPtYVJIoBfYrkhFR1ahrG5/+ZErz:PBdlwHRn+WlYV+5rkhFR18rG5H

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NzYwNjA2ODE3NTk2MjEzMw.G3Bv2h.Oi-mmhg6ZK_uTFZKjQiDOwr-wcEm-Hq0xizKtQ
server_id
1247606720864321577

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	RobloxAdminPanelNewLeakedgpj.exe

Executes dropped EXE 1 IoCs

pid	Process
4708	backdoor.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
28	discord.com
33	discord.com
59	discord.com
71	discord.com
26	discord.com
60	discord.com
62	raw.githubusercontent.com
63	raw.githubusercontent.com
65	discord.com
68	discord.com
72	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	backdoor.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4708	4888	RobloxAdminPanelNewLeakedgpj.exe	93
PID 4888 wrote to memory of 4708	4888	RobloxAdminPanelNewLeakedgpj.exe	93

C:\Users\Admin\AppData\Local\Temp\RobloxAdminPanelNewLeakedgpj.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxAdminPanelNewLeakedgpj.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe

Filesize
86KB

MD5
da73d03e7e63df84355ca62baaefae8a

SHA1
4a24296ce0275ab6d5439a155a17d8de80d549d5

SHA256
16cef3c03efe6d11b261709e330058536b7bd186fad81e932f2a9db1cef78610

SHA512
7d8c28fa0ee62228104af1bd25aefe3f18fea9e9983d1cbcfa2f18f9f2832c5471fe4f545e775f6ed775802b3d687d81c1a14292af3406f6ef613c39e0c617e7

Download Submit
memory/4708-14-0x00007FFAE8703000-0x00007FFAE8705000-memory.dmp

Filesize
8KB

Download
memory/4708-15-0x0000021BFFA20000-0x0000021BFFA3A000-memory.dmp

Filesize
104KB

Download
memory/4708-16-0x0000021C001D0000-0x0000021C00392000-memory.dmp

Filesize
1.8MB

Download
memory/4708-17-0x00007FFAE8700000-0x00007FFAE91C1000-memory.dmp

Filesize
10.8MB

Download
memory/4708-18-0x0000021B9B4B0000-0x0000021B9B9D8000-memory.dmp

Filesize
5.2MB

Download
memory/4708-19-0x00007FFAE8703000-0x00007FFAE8705000-memory.dmp

Filesize
8KB

Download
memory/4708-20-0x00007FFAE8700000-0x00007FFAE91C1000-memory.dmp

Filesize
10.8MB

Download
memory/4708-21-0x0000021B9B0C0000-0x0000021B9B0CE000-memory.dmp

Filesize
56KB

Download