discordrat | ef0a68584ffb12486dd684caf8c045b7bccc8808eac1367351473ef7635bf0ef | Triage

Analysis

max time kernel
47s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 17:19

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

4595405e379f3a98e6bc9a09c6750761
SHA1

a6f77013b3085a5ee2bb3fd3a4f79c3667f095c4
SHA256

ef0a68584ffb12486dd684caf8c045b7bccc8808eac1367351473ef7635bf0ef
SHA512

4ec1c3982f1834c0b4e1f8596b780d98070d8172c3800a6f342b2cce285206eb8790a5111d44bd6572485118f53397e43e05f8e4f2c166c10298e0225457ddf6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NjkzMDQ4NTc1NDcyODQ3OQ.G2Ez2L.ikoKtH1edR3EO6mOTqlbo0NPlrKvu3OllZO36c
server_id
1241777458810982452

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1968	2080	Client-built.exe	28
PID 2080 wrote to memory of 1968	2080	Client-built.exe	28
PID 2080 wrote to memory of 1968	2080	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 600
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x000000013F7D0000-0x000000013F7E8000-memory.dmp

Filesize
96KB

Download
memory/2080-2-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-3-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download