discordrat | 74b6089379acff9803a37c3b5e8bc86c5877a319c4ced5a714ff9c9c63905188 | Triage

Resubmissions

25-06-2024 14:50

240625-r7v2payhnn 10

25-06-2024 14:48

240625-r6e9vayhjr 10

25-06-2024 14:40

240625-r18zzayfjm 10

25-06-2024 14:36

240625-ryzzaaydqj 10

25-06-2024 14:34

240625-rxl12avhqa 10

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 14:36

Sharing

Report Analysis Logs

General

Target

cdumper/compiler.exe
Size

78KB
MD5

cc0c0d53ea855321b892e9d69ce09d1f
SHA1

604de3c919a7768f107e15c12c816ed11ea0146f
SHA256

cd28a30e4e7970b5fe7e2d2ab0244a41ed3fed048904d671ce2db28de1a87529
SHA512

58a7a3e9b374296d8898929a9c1806beb501e45c232efd11db1449583e8227b4a0511fc724d07be030baa640aa285ed7648ed1a328a40e47989b0d7673a4d609
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1MzY2NzkzMTcwMzc0MjQ3NA.Gw8dsn.LeG778rjIzDyfb3CK-K3udb1GPBgWlxFwh_VdU
server_id
1250682422434074634

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

compiler.exe

description	pid	process	target process
PID 3040 wrote to memory of 3004	3040	compiler.exe	WerFault.exe
PID 3040 wrote to memory of 3004	3040	compiler.exe	WerFault.exe
PID 3040 wrote to memory of 3004	3040	compiler.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe
"C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3040 -s 596
2⤵
PID:3004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/3040-1-0x000000013F950000-0x000000013F968000-memory.dmp

Filesize
96KB

Download
memory/3040-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/3040-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download