Analysis Overview

score

10^/10

SHA256

66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce

Threat Level: Known bad

The file 66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce was found to be: Known bad.

Malicious Activity Summary

discordrat persistence rat rootkit stealer

Discordrat family

Discord RAT

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-23 23:29

Signatures

Discordrat family

discordrat

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 23:29

Reported

2024-06-23 23:31

Platform

win7-20240508-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2228 wrote to memory of 2396	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	C:\Windows\system32\WerFault.exe
PID 2228 wrote to memory of 2396	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	C:\Windows\system32\WerFault.exe
PID 2228 wrote to memory of 2396	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe

"C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2228 -s 600

Network

N/A

Files

memory/2228-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

memory/2228-1-0x000000013F930000-0x000000013F948000-memory.dmp

memory/2228-2-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

memory/2228-3-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 23:29

Reported

2024-06-23 23:30

Platform

win10v2004-20240508-en

Max time kernel

42s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe

"C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding