discordrat | 134bc640e8cc14d6c30f91407a8c812a63319072343bbf8a6bc2aaf3a902d44b

Analysis

max time kernel
38s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 04:53

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Wave.exe
Size

505KB
MD5

634012a39686513995ecbbaf04235a0a
SHA1

6204df4370ed114bde2caac305f96b1954e68504
SHA256

134bc640e8cc14d6c30f91407a8c812a63319072343bbf8a6bc2aaf3a902d44b
SHA512

b8881eb85dc001d4c256a60dbc141592f89ffded8f90d2240c80d6af6468a34e1ac52e288170c0296cf1afe735e7ef7da6a4738adcfc253fded53c7c56ebe002
SSDEEP

12288:TyveQB/fTHIGaPkKEYzURNAwbAg8ox4CA9ndmc:TuDXTIGaPhEYzUzA0qV9nkc

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NDI4MDkwNjYzODc1Mzg2Mw.GB5zNE.lgu4CSBwMUVxaeb6e0u9sFYW6gLtr8IglmywhI
server_id
1189676766084735048

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Wave.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Wave.exe
Executes dropped EXE 1 IoCs

Processes:

Client-built.exe

pid process

392 Client-built.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

31 discord.com
32 discord.com
40 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exe

description pid process

Token: SeDebugPrivilege 392 Client-built.exe
Token: SeShutdownPrivilege 392 Client-built.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Wave.exe

pid	process
392	Client-built.exe

flow	ioc
31	discord.com
32	discord.com
40	discord.com

description	pid	process
Token: SeDebugPrivilege	392	Client-built.exe
Token: SeShutdownPrivilege	392	Client-built.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Wave.exe

description	pid	process	target process
PID 4488 wrote to memory of 392	4488	Wave.exe	Client-built.exe
PID 4488 wrote to memory of 392	4488	Wave.exe	Client-built.exe

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4488

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:392

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
Filesize
78KB

MD5
c2207566970ad0379a62da59e3c4caff

SHA1
59759d884744c5c025fe800a0b86b63555f7bfe9

SHA256
61247d55a049a1a16833a6be90b50ceef20340db7b31181b07d95cbc345dd1ba

SHA512
2b6a2684c1a5db78fc1080c26b7263bb5c04eb760d142369cd4d987b35ff9fd76092fe3ceae0633f26f98a12b4d1b5b4aca7071a7022d22d264237dbf1a488bc

Download Submit
memory/392-12-0x0000020634A70000-0x0000020634A88000-memory.dmp

Filesize
96KB

Download
memory/392-13-0x00007FFE36403000-0x00007FFE36405000-memory.dmp

Filesize
8KB

Download
memory/392-14-0x000002064F0E0000-0x000002064F2A2000-memory.dmp

Filesize
1.8MB

Download
memory/392-15-0x00007FFE36400000-0x00007FFE36EC1000-memory.dmp

Filesize
10.8MB

Download
memory/392-16-0x000002064F9D0000-0x000002064FEF8000-memory.dmp

Filesize
5.2MB

Download
memory/392-17-0x00007FFE36403000-0x00007FFE36405000-memory.dmp

Filesize
8KB

Download
memory/392-18-0x00007FFE36400000-0x00007FFE36EC1000-memory.dmp

Filesize
10.8MB

Download