discordrat | 134bc640e8cc14d6c30f91407a8c812a63319072343bbf8a6bc2aaf3a902d44b

Analysis

max time kernel
1778s
max time network
1787s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-06-2024 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wave.exe
Size

505KB
MD5

634012a39686513995ecbbaf04235a0a
SHA1

6204df4370ed114bde2caac305f96b1954e68504
SHA256

134bc640e8cc14d6c30f91407a8c812a63319072343bbf8a6bc2aaf3a902d44b
SHA512

b8881eb85dc001d4c256a60dbc141592f89ffded8f90d2240c80d6af6468a34e1ac52e288170c0296cf1afe735e7ef7da6a4738adcfc253fded53c7c56ebe002
SSDEEP

12288:TyveQB/fTHIGaPkKEYzURNAwbAg8ox4CA9ndmc:TuDXTIGaPhEYzUzA0qV9nkc

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NDI4MDkwNjYzODc1Mzg2Mw.GB5zNE.lgu4CSBwMUVxaeb6e0u9sFYW6gLtr8IglmywhI
server_id
1189676766084735048

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Executes dropped EXE 1 IoCs

Processes:

Client-built.exe

pid process

4068 Client-built.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client-built.exe

description pid process

Token: SeDebugPrivilege 4068 Client-built.exe

pid	process
4068	Client-built.exe

description	pid	process
Token: SeDebugPrivilege	4068	Client-built.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Wave.exe

description	pid	process	target process
PID 1784 wrote to memory of 4068	1784	Wave.exe	Client-built.exe
PID 1784 wrote to memory of 4068	1784	Wave.exe	Client-built.exe

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
Filesize
78KB

MD5
c2207566970ad0379a62da59e3c4caff

SHA1
59759d884744c5c025fe800a0b86b63555f7bfe9

SHA256
61247d55a049a1a16833a6be90b50ceef20340db7b31181b07d95cbc345dd1ba

SHA512
2b6a2684c1a5db78fc1080c26b7263bb5c04eb760d142369cd4d987b35ff9fd76092fe3ceae0633f26f98a12b4d1b5b4aca7071a7022d22d264237dbf1a488bc

Download Submit
memory/4068-12-0x00007FFD03473000-0x00007FFD03475000-memory.dmp

Filesize
8KB

Download
memory/4068-13-0x000002ACB2DE0000-0x000002ACB2DF8000-memory.dmp

Filesize
96KB

Download
memory/4068-14-0x000002ACCD560000-0x000002ACCD722000-memory.dmp

Filesize
1.8MB

Download
memory/4068-15-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download
memory/4068-16-0x00007FFD03470000-0x00007FFD03F32000-memory.dmp

Filesize
10.8MB

Download