discordrat | c6aaf0b451168ddd73647d266758bb7abeb7cf91aac4161be2b1dff309d33d78 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 20:47

Sharing

Report Analysis Logs

General

Target

Wave Installer.exe
Size

78KB
MD5

6cb6c89f2f5a919f2d961401dee14179
SHA1

81b6a8441e267ec0cb8bc2f0dd542e5ba3fc43b7
SHA256

c6aaf0b451168ddd73647d266758bb7abeb7cf91aac4161be2b1dff309d33d78
SHA512

1d8911dce7ce9b44be57ec73d114f0033adda54754f9908814a7f64999260d8bcb45280cb746051741dea6ee8c77f37ab2d58df656805f9005ff39ea4def48eb
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+lPIC:5Zv5PDwbjNrmAE+1IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NzA1NDA4OTA1Mzg2ODA4Mg.GIzae-.Cfy3Zch9tdGvSAixgwx_6XH4iNIzUWWxKzlDr4
server_id
1257057788819931207

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Wave Installer.exe

description	pid	process	target process
PID 1868 wrote to memory of 2976	1868	Wave Installer.exe	WerFault.exe
PID 1868 wrote to memory of 2976	1868	Wave Installer.exe	WerFault.exe
PID 1868 wrote to memory of 2976	1868	Wave Installer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Wave Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Wave Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1868 -s 596
2⤵
PID:2976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-0-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

Filesize
4KB

Download
memory/1868-1-0x000000013F250000-0x000000013F268000-memory.dmp

Filesize
96KB

Download
memory/1868-2-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Filesize
9.9MB

Download
memory/1868-3-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

Filesize
4KB

Download