discordrat | 6624c79c2c07fbcb8d4244fadd4e16ad4c536c187c25acaf3b831fff7cbda3c9 | Triage

Resubmissions

25-06-2024 14:37

240625-ry7dcsydrk 10

25-06-2024 00:26

240625-arelbstdjr 10

Analysis

max time kernel
0s
max time network
1s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 00:26

Sharing

Report Analysis Logs

General

Target

yjnclient-v3.exe
Size

78KB
MD5

f758d08d23a5ddf8905d5c17084abf07
SHA1

b237a04b0ab5374f41ec90186d1de0250569a82d
SHA256

6624c79c2c07fbcb8d4244fadd4e16ad4c536c187c25acaf3b831fff7cbda3c9
SHA512

7fd582bb2c319d1cd43efa1d01420f2e58378c15542c044b2450da0da0112a55ae98afd52e851da767d487456927556152d3925ef11194c35bb25bcc9b7f747f
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+BAPIC:5Zv5PDwbjNrmAE+OIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NDkyMzczMDE3ODY3NDgwMw.GNKnH3._2hi153EQeLcF4SWSwr0pQuzH__TVonJih1mFM
server_id
1254923576340119644

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

yjnclient-v3.exe

description	pid	process	target process
PID 2344 wrote to memory of 2244	2344	yjnclient-v3.exe	WerFault.exe
PID 2344 wrote to memory of 2244	2344	yjnclient-v3.exe	WerFault.exe
PID 2344 wrote to memory of 2244	2344	yjnclient-v3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\yjnclient-v3.exe
"C:\Users\Admin\AppData\Local\Temp\yjnclient-v3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2344 -s 596
2⤵
PID:2244

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2344-1-0x000000013FDF0000-0x000000013FE08000-memory.dmp

Filesize
96KB

Download
memory/2344-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download