discordrat | c902d6571697ad044ac2c0090d522d115d3e06ab672ca355e3d9085b6c77e304 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 07:27

Sharing

Report Analysis Logs

General

Target

PanelExecutor-Fixer.exe
Size

78KB
MD5

e265a5b1fe4e46c72e018e5b7376563e
SHA1

c45441fe1c0b431ad69915c3242398a16f8c19bb
SHA256

c902d6571697ad044ac2c0090d522d115d3e06ab672ca355e3d9085b6c77e304
SHA512

8b1a9f0068ffb499dd02392f6eb4fb7e16c84b23932c8b6d5e6c12512c8370f1466eda856181045fe4f0addbac0f231f3ac78219a565752db963be19dc46e5b5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+1PIC:5Zv5PDwbjNrmAE+lIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1ODY0ODcyMTY2MzU5MDQzMA.GiwjRC.iYf3r79g3-ZKRAfGjtWZw33DYNFg759sGho8y8
server_id
1247781121165623369

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

PanelExecutor-Fixer.exe

description	pid	process	target process
PID 2916 wrote to memory of 2996	2916	PanelExecutor-Fixer.exe	WerFault.exe
PID 2916 wrote to memory of 2996	2916	PanelExecutor-Fixer.exe	WerFault.exe
PID 2916 wrote to memory of 2996	2916	PanelExecutor-Fixer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PanelExecutor-Fixer.exe
"C:\Users\Admin\AppData\Local\Temp\PanelExecutor-Fixer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2916 -s 596
2⤵
PID:2996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2916-1-0x000000013F270000-0x000000013F288000-memory.dmp

Filesize
96KB

Download
memory/2916-2-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2916-3-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download