discordrat | d0452f63e207ead4ba0828fba9cd46d54c08906ac3f35f1c0b27dda2d60fbc83

Analysis

max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

solarabootstraper.exe
Size

497KB
MD5

48258af1b1134dffa388c6f2590325c3
SHA1

e2fa6a4351d7b358e6b20e9194b63b54751458d4
SHA256

d0452f63e207ead4ba0828fba9cd46d54c08906ac3f35f1c0b27dda2d60fbc83
SHA512

1eeceefb8843f72b55e1b517039ab53cd72af3bb294fe9b06ce0a6207749506bf299cd913a4a1088ffa002069821d346ec3fc045fa701014110beec03d7d208c
SSDEEP

12288:4yveQB/fTHIGaPkKEYzURNA/bAgzfCxS6PZXOB4:4uDXTIGaPhEYzUzAT4SwZXv

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzOTEzMTk4MTc4NzI5OTkxMg.G2PouQ.rmLVRC29c13dyUDlcJhFL4MtNpJCMM3OTOmuyI
server_id
1254334525543288912

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	solarabootstraper.exe

Executes dropped EXE 1 IoCs

pid	Process
4812	test.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
33	discord.com
34	discord.com
38	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	test.exe
Token: SeShutdownPrivilege	4812	test.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4812	1428	solarabootstraper.exe	93
PID 1428 wrote to memory of 4812	1428	solarabootstraper.exe	93

C:\Users\Admin\AppData\Local\Temp\solarabootstraper.exe
"C:\Users\Admin\AppData\Local\Temp\solarabootstraper.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe

Filesize
78KB

MD5
cd0398fb5a04ce43be2b1183e7dfad06

SHA1
e1e9ac1f1f2533f3bfec802cae2cbeeeac65c181

SHA256
c4fb94399b109d19585a03233be7663000aae8c7c7f8661ce744c59bfa8ced08

SHA512
50bfd2614078082fd83e43e61a36b086eae0fec2399fae5655c6442a474ffb7c25cabe43b4c484c85acc4fac72c2f2613dc00e85045242dfcdd91093519699bc

Download Submit
memory/4812-14-0x0000023011CE0000-0x0000023011CF8000-memory.dmp

Filesize
96KB

Download
memory/4812-15-0x00007FFAADCB3000-0x00007FFAADCB5000-memory.dmp

Filesize
8KB

Download
memory/4812-16-0x000002302C280000-0x000002302C442000-memory.dmp

Filesize
1.8MB

Download
memory/4812-17-0x00007FFAADCB0000-0x00007FFAAE771000-memory.dmp

Filesize
10.8MB

Download
memory/4812-18-0x000002302D330000-0x000002302D858000-memory.dmp

Filesize
5.2MB

Download
memory/4812-19-0x00007FFAADCB3000-0x00007FFAADCB5000-memory.dmp

Filesize
8KB

Download
memory/4812-20-0x00007FFAADCB0000-0x00007FFAAE771000-memory.dmp

Filesize
10.8MB

Download