discordrat | a77388ef2a7aa231dfffce78d26fc23c5d8aa38f2b76750c6d04bc0b9a3486c1 | Triage

Submit
Reports

Overview

overview

Static

static

3

3add9057e5...cs.exe

windows7-x64

3add9057e5...cs.exe

windows10-2004-x64

Analysis

max time kernel
7s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 05:18

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3add9057e56fe6ed3826b37110946af0_NeikiAnalytics.exe

Resource

win7-20240221-en

discordrat persistence rat rootkit stealer

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

3add9057e56fe6ed3826b37110946af0_NeikiAnalytics.exe

Resource

win10v2004-20240426-en

discordrat persistence rat rootkit stealer

windows10-2004-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target

3add9057e56fe6ed3826b37110946af0_NeikiAnalytics.exe
Size

420KB
MD5

3add9057e56fe6ed3826b37110946af0
SHA1

f5235cb1fec12a3bd1ff426be43382b7e2f52123
SHA256

a77388ef2a7aa231dfffce78d26fc23c5d8aa38f2b76750c6d04bc0b9a3486c1
SHA512

3312405b72d48d16aa396f98bd65d4630478d6eaf339ca8109eca3ed897f3d7b2a4c4bf37adcde1809c9c3180f342be04426ad2303b6070e0fca570a64918a37
SSDEEP

12288:oJf/DdUC83OIgFc+tYjhLFHB0iTpc0Kkd8oPEB5:oN/BUBb+tYjBFHBxTaYbPI

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0Njg5NDU5NjYxNzY2NjY4NA.Gmlbm4.ZRFvWtjlMHl2DRYmK54Ou3DlvwIiGhmTqRBYyU
server_id
1246895020653416468

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Processes

C:\Users\Admin\AppData\Local\Temp\3add9057e56fe6ed3826b37110946af0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3add9057e56fe6ed3826b37110946af0_NeikiAnalytics.exe"
1⤵
PID:4504
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Audio.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Audio.exe"
  2⤵
  PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Audio.exe

Filesize
78KB

MD5
fe5bee67891649b12d45121e6120238a

SHA1
0bb63a513cd1ce3cbdaf46cf025b59912bd4208a

SHA256
5d8777f9fc0aa00b19e084a66d3f959e8feb37d38933788ebdc0c8d8edf25791

SHA512
54021dd6ffcf7e245fecd5352ca2e6aeeeb6deaf514b16d0a4e754b3606597ff354bb568ff5a751e11c4cc2bbdf88b97eed80d2f8defb5087581be0f0a847486

Download Submit
memory/332-15-0x0000016D07CD0000-0x0000016D07CE8000-memory.dmp

Filesize
96KB

Download
memory/332-16-0x0000016D22400000-0x0000016D225C2000-memory.dmp

Filesize
1.8MB

Download
memory/332-14-0x00007FFB31EC3000-0x00007FFB31EC5000-memory.dmp

Filesize
8KB

Download
memory/332-17-0x00007FFB31EC0000-0x00007FFB32981000-memory.dmp

Filesize
10.8MB

Download
memory/332-18-0x0000016D22B00000-0x0000016D23028000-memory.dmp

Filesize
5.2MB

Download
memory/332-19-0x00007FFB31EC0000-0x00007FFB32981000-memory.dmp

Filesize
10.8MB

Download

© 2018-2024

Terms | Privacy