discordrat | a62c90a78d55e45f0b9a6c67fe576102cebbe5266661f1631fae2deec6719967 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 23:33

Sharing

Report Analysis Logs

General

Target

release/SolaraBETA.exe
Size

164KB
MD5

d2030a995a529f7b3e7b13b15d5ed7f4
SHA1

e1901fbf88727d21c8dad1629bfe51e0e89b33cd
SHA256

640e8e45aa8817067ce553906216a54b5c2bc398af05d6fd9a015377d4ba2e14
SHA512

6ad52f7d17da63d5f4359b1b4b7f698ced20cdbdb84a1a8ffbd7e4deef988cf397b9e06a39053c1f7f2944f229b896a40ddf3b0d1c043ca18d4abcc3c069d880
SSDEEP

3072:2Zv5PDwbjNrmAE+gIjLdGgCvZuT75lTT3MJObhH:Wv5PDwbBr0IjLdvm27wJON

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5NTg0ODc1MjI0NjgyNTA1Mg.Gaa15m.6P5B1ZqVZDkzEJ1KJVCwEZrI2qMc_iYTK6lSK0
server_id
1246418800182824981

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SolaraBETA.exe

description	pid	process	target process
PID 2776 wrote to memory of 2968	2776	SolaraBETA.exe	WerFault.exe
PID 2776 wrote to memory of 2968	2776	SolaraBETA.exe	WerFault.exe
PID 2776 wrote to memory of 2968	2776	SolaraBETA.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\release\SolaraBETA.exe
"C:\Users\Admin\AppData\Local\Temp\release\SolaraBETA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2776 -s 596
2⤵
PID:2968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-1-0x000000013FA00000-0x000000013FA2C000-memory.dmp

Filesize
176KB

Download
memory/2776-0-0x000007FEF5C43000-0x000007FEF5C44000-memory.dmp

Filesize
4KB

Download
memory/2776-2-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-3-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download