discordrat | c37a22c31c74ab86ca27a6cc482bc8ab3e38d9865f1875981471ab11698538dd

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Desktop.exe
Size

8.7MB
MD5

757bcc0d9818642cf387eec015937f87
SHA1

41306ea2814b6722388c0afcae14634b3f60fa80
SHA256

c37a22c31c74ab86ca27a6cc482bc8ab3e38d9865f1875981471ab11698538dd
SHA512

ba25a5859a1291cc3299aa9ea1eddcabef2ffd13ac24a3890a7a4d186c19511cf42b4a9e7d54ddaa463fc7a05a3317df63e67b73831c5bcce803d87bae6f2543
SSDEEP

196608:Aqw6LrkVIEwGgq6TPcYvdAUNseMuakMlSatoZhz+JmpoX6:RAJ6TPHvbf53at0hSm2X6

Score

10^/10

discordrat persistence rat rootkit stealer upx

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NjcxMzUzNDUxNjAzNTY2NA.Gxl_pA.KE9MjXSVDtnUBHfXBt-PJLOkYAdTCbZUddEf-Q
server_id
1248003561623781476

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Executes dropped EXE 4 IoCs

Processes:

Built.exeBuilt.exeClient-built.exe

pid process

2092 Built.exe
2484 Built.exe
1200
344 Client-built.exe

pid	process
2092	Built.exe
2484	Built.exe
1200
344	Client-built.exe

Loads dropped DLL 15 IoCs

Processes:

Desktop.exeBuilt.exeBuilt.exeWerFault.exe

pid	process
1180	Desktop.exe
2092	Built.exe
2484	Built.exe
2484	Built.exe
2484	Built.exe
2484	Built.exe
2484	Built.exe
2484	Built.exe
2484	Built.exe
1180	Desktop.exe
2376	WerFault.exe
2376	WerFault.exe
2376	WerFault.exe
2376	WerFault.exe
2376	WerFault.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI20922\python311.dll	upx
behavioral1/memory/2484-86-0x000007FEF6110000-0x000007FEF66FE000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Desktop.exeBuilt.exeClient-built.exe

description	pid	process	target process
PID 1180 wrote to memory of 2092	1180	Desktop.exe	Built.exe
PID 1180 wrote to memory of 2092	1180	Desktop.exe	Built.exe
PID 1180 wrote to memory of 2092	1180	Desktop.exe	Built.exe
PID 2092 wrote to memory of 2484	2092	Built.exe	Built.exe
PID 2092 wrote to memory of 2484	2092	Built.exe	Built.exe
PID 2092 wrote to memory of 2484	2092	Built.exe	Built.exe
PID 1180 wrote to memory of 344	1180	Desktop.exe	Client-built.exe
PID 1180 wrote to memory of 344	1180	Desktop.exe	Client-built.exe
PID 1180 wrote to memory of 344	1180	Desktop.exe	Client-built.exe
PID 344 wrote to memory of 2376	344	Client-built.exe	WerFault.exe
PID 344 wrote to memory of 2376	344	Client-built.exe	WerFault.exe
PID 344 wrote to memory of 2376	344	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Built.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Built.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Built.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Built.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 344 -s 596
3⤵
- Loads dropped DLL
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
78KB

MD5
9b4405d0367001ac73032c7991629293

SHA1
95b2dec995dc259322ee972d9ae4db9ad82833ca

SHA256
2509514a2d6a36108ed3ae1cab27cd75ec8e8db8449860e05dad15bbeeaf879d

SHA512
12c34b61ad38349b9063ddfc452dc3782f64a5f4d332d0d9d84b08b0ccf7b6bed544959edd2178fefda2f8289e7da5f7e56ccbd3a7dfb71f71fdc010d225b1ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20922\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20922\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20922\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20922\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20922\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Built.exe

Filesize
8.1MB

MD5
2bab7f015f029a61bfa6566c43e6dbc2

SHA1
789f42293cdffede139828d1378e61f958087a55

SHA256
2522129a9c38dff21b9e64aedb598baef7dc4b534ee467e86f88cabe197262f5

SHA512
3621de2f81405a0d345dfe9c6cc9963b6b5b431a938a54a6bc45df95ff241e3f9c684b3f602c55a7ba0a8002a94649300b5ff681e8492aff1dd392a1355a3238

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20922\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20922\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
memory/344-148-0x000000013FCC0000-0x000000013FCD8000-memory.dmp

Filesize
96KB

Download
memory/344-147-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/344-153-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/344-155-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/344-156-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/2484-86-0x000007FEF6110000-0x000007FEF66FE000-memory.dmp

Filesize
5.9MB

Download