discordrat | ba6cef0aab977a4f4fc7e91d257205cc99634002b5f4f2a7ad7fcd41a9ec52f9 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 15:52

Sharing

Report Analysis Logs

General

Target

backdoor.exe
Size

78KB
MD5

e171e60b87329f0d0b505fac4ed4a4b7
SHA1

235df53c9dd99f010d110e94bc8de5a868a208f0
SHA256

cf194b811a46dbd3fd51b4ab88ff7659ef3a13b603e5c244c2cbdc994f80457c
SHA512

c32c1d43318117bb3aff56f1b3d3f9f0d804f621439b386470de25566a09adbc99d8cf3e73e32517317fdfeb4a5b0c961060b4409ae97b42bdf7b9a4b1febd18
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+lPIC:5Zv5PDwbjNrmAE+1IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzNTY0ODQ4NjI5MzM3Mjk0OA.GawiEy.JlM1vJUWlJwIzz8HRFWqauqv72ly3Fb8B_Rxtc
server_id
1235649426538758245

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2440	2352	backdoor.exe	28
PID 2352 wrote to memory of 2440	2352	backdoor.exe	28
PID 2352 wrote to memory of 2440	2352	backdoor.exe	28

C:\Users\Admin\AppData\Local\Temp\backdoor.exe
"C:\Users\Admin\AppData\Local\Temp\backdoor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2352 -s 596
  2⤵
  PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x000007FEF5E63000-0x000007FEF5E64000-memory.dmp

Filesize
4KB

Download
memory/2352-1-0x000000013FF40000-0x000000013FF58000-memory.dmp

Filesize
96KB

Download
memory/2352-2-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2352-3-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download