discordrat | 6fbb1c25814dd749fb423bc4f9bca99919030278a27ca09b9f997b3ef84d3c1d | Triage

Analysis

max time kernel
123s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 07:52

Sharing

Report Analysis Logs

General

Target

disable_infection.exe
Size

78KB
MD5

5680a6247bf2ac6bd97f463863b3790c
SHA1

6a18553f769b60cc23b7fe5c87f3fcc1de060d36
SHA256

6fbb1c25814dd749fb423bc4f9bca99919030278a27ca09b9f997b3ef84d3c1d
SHA512

9ccdd13ab4d40542c4f38c6cee4553d7179d08b7e4926170fb582a6f6303e9c2358538f2b5b936e3112943b0df394c08350cc4b35e64c93c2831a8ceec738a18
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1MTE4NjM4OTk1MzgxMDQ5NQ.GcIZgp.AMqtZCZqZtUob-d3gzU2LOM5ax5FJRSnHAEFIA
server_id
1250120108064378900

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

disable_infection.exe

description	pid	process	target process
PID 1808 wrote to memory of 1748	1808	disable_infection.exe	WerFault.exe
PID 1808 wrote to memory of 1748	1808	disable_infection.exe	WerFault.exe
PID 1808 wrote to memory of 1748	1808	disable_infection.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\disable_infection.exe
"C:\Users\Admin\AppData\Local\Temp\disable_infection.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1808 -s 596
2⤵
PID:1748

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/1808-1-0x000000013FDF0000-0x000000013FE08000-memory.dmp

Filesize
96KB

Download
memory/1808-2-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/1808-3-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download