discordrat | 40a705165bed85c9222db3909f65535f16b41d970f1eac7f76bb6d668c6a42bd | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 17:01

Sharing

Report Analysis Logs

General

Target

EXOTICSPOOFER.exe
Size

78KB
MD5

dfa5cb019d9d54fb8f2e9c45087a2d7f
SHA1

5a81d19b82c4687981a9c05353a6b2c6a715ee2c
SHA256

40a705165bed85c9222db3909f65535f16b41d970f1eac7f76bb6d668c6a42bd
SHA512

805f87a1ba2c47e6b6f91a3287ed38897f5e45fdde810edad3630a4368c377e45b43bfd5950716f83130be52ce6373f0c9aa7d46f03053290b230c9310922215
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NTQ3NzU2NTk1NTUwNjE5Nw.GQUX06.Pbq0TWF2GRv-SAO5r1-eUeE6Sd2lIdRSlv47kk
server_id
1255474002336546846

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

EXOTICSPOOFER.exe

description	pid	process	target process
PID 1676 wrote to memory of 2236	1676	EXOTICSPOOFER.exe	WerFault.exe
PID 1676 wrote to memory of 2236	1676	EXOTICSPOOFER.exe	WerFault.exe
PID 1676 wrote to memory of 2236	1676	EXOTICSPOOFER.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\EXOTICSPOOFER.exe
"C:\Users\Admin\AppData\Local\Temp\EXOTICSPOOFER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1676 -s 596
2⤵
PID:2236

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2388

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/1676-1-0x000000013F490000-0x000000013F4A8000-memory.dmp

Filesize
96KB

Download
memory/1676-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1676-3-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download