discordrat | ab65e67c571c618dec96e67b90c2fc1f23cc14d890a47097af24d9cac3a0d033 | Triage

Analysis

max time kernel
1565s
max time network
1567s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 18:14

Sharing

Report Analysis Logs

General

Target

Microsoft Teams.exe
Size

78KB
MD5

63e862de6af5361db7e5a02cc0cda36b
SHA1

6608a2831a6fc48bc0df5a90fc09898ce8cae57a
SHA256

ab65e67c571c618dec96e67b90c2fc1f23cc14d890a47097af24d9cac3a0d033
SHA512

7cb2fdf29c77a1441ceedfa065b7b3573a149d39aebd58aa0c1fd08f4e1a25a65b9c830bf71b29e42b10add52f4e91e7657291a8fd09c182a28d606ebf20196f
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyNjA4MTg3MzUwMDA0OTQwOA.GH2uyJ._HNe7GUeOVG-0ZK1ROMpF__BHGM43d6YVff2Fk
server_id
1127634661301026827

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Microsoft Teams.exe

description	pid	process	target process
PID 2204 wrote to memory of 1704	2204	Microsoft Teams.exe	WerFault.exe
PID 2204 wrote to memory of 1704	2204	Microsoft Teams.exe	WerFault.exe
PID 2204 wrote to memory of 1704	2204	Microsoft Teams.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Microsoft Teams.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Teams.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2204 -s 600
2⤵
PID:1704

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2112

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/2204-1-0x000000013FB80000-0x000000013FB98000-memory.dmp

Filesize
96KB

Download
memory/2204-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/2204-3-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download