discordrat | 85a287edb6eeb66eeada945ff71c946a76171be92244071c07d0ac5553d96cf2 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 03:33

Sharing

Report Analysis Logs

General

Target

c053ebb3f0f90a7705729579d25dd194.exe
Size

78KB
MD5

c053ebb3f0f90a7705729579d25dd194
SHA1

fe045f0584ee3656af1e89a6ca37ef68e7f252a3
SHA256

85a287edb6eeb66eeada945ff71c946a76171be92244071c07d0ac5553d96cf2
SHA512

a5beac0ec0b1ecad655f52555ff83d756169335be383bd2dd4310b4e9d2120fb939ed42116554ae1544ed9db56a3846d6ca0369d2af0430a8d7c3717e2223854
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NzYzMjcxMjk1Nzk1NjE4Nw.G3MXNZ.B896PWyca43CGShZp7WvFVoaKLYOSP1no8IyaM
server_id
1247637478639271976

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2976	2280	c053ebb3f0f90a7705729579d25dd194.exe	28
PID 2280 wrote to memory of 2976	2280	c053ebb3f0f90a7705729579d25dd194.exe	28
PID 2280 wrote to memory of 2976	2280	c053ebb3f0f90a7705729579d25dd194.exe	28

C:\Users\Admin\AppData\Local\Temp\c053ebb3f0f90a7705729579d25dd194.exe
"C:\Users\Admin\AppData\Local\Temp\c053ebb3f0f90a7705729579d25dd194.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2280 -s 600
  2⤵
  PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

Filesize
4KB

Download
memory/2280-1-0x000000013FB00000-0x000000013FB18000-memory.dmp

Filesize
96KB

Download
memory/2280-2-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Filesize
9.9MB

Download
memory/2280-3-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Filesize
9.9MB

Download