discordrat | d99a4d776f04dfd3e8004c466ab81788da8f0ba08b83430df4dd984fa1ef4e39 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 19:05

Sharing

Report Analysis Logs

General

Target

veydovokna.exe
Size

78KB
MD5

7ee32f2553fa474e79b2f1a444172735
SHA1

fc17876384c197f73a7471850d13748aa6f659b0
SHA256

d99a4d776f04dfd3e8004c466ab81788da8f0ba08b83430df4dd984fa1ef4e39
SHA512

2789dc16e615f28c29f5e81ade9e4b03a47d9855cc9092bbcdf90ce7419fe38cabd729a87f038f4aa3d8e2f5317ac69a0637737f468dd8d05532dbd3dda738b9
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NjYyNDkzOTk3MzQ4MDYzOA.GmmRJ5.-nbYbt2H8apuatUJNXT2gF-Pq4ZpLJRKwy0hls
server_id
1257063713945419826

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1736	1764	veydovokna.exe	28
PID 1764 wrote to memory of 1736	1764	veydovokna.exe	28
PID 1764 wrote to memory of 1736	1764	veydovokna.exe	28

C:\Users\Admin\AppData\Local\Temp\veydovokna.exe
"C:\Users\Admin\AppData\Local\Temp\veydovokna.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1764 -s 596
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-0-0x000007FEF5A53000-0x000007FEF5A54000-memory.dmp

Filesize
4KB

Download
memory/1764-1-0x000000013F760000-0x000000013F778000-memory.dmp

Filesize
96KB

Download
memory/1764-2-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

Filesize
9.9MB

Download
memory/1764-3-0x000007FEF5A53000-0x000007FEF5A54000-memory.dmp

Filesize
4KB

Download