discordrat | 9756ee53e23f0d4b0b99395167020ee817d255c686b5643aee5540a274e7d6e6 | Triage

Analysis

max time kernel
23s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 06:40

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

c2efae565750c5e4840301c5cec67460
SHA1

ea1499fac62658c92b770423e934063d4a2a9f78
SHA256

9756ee53e23f0d4b0b99395167020ee817d255c686b5643aee5540a274e7d6e6
SHA512

236b0273e0c7310d8a88068559a074793b7a3f1e7497b69a78674030cb4a021d22e2a02147a5f678a440a16f98c96bd2bc57ce69284f1e37ae05b530805f16ee
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzODk5NzI3ODYzMTM5NTM3OQ.Gn6NJ3.UNQS-_aC6k865Ijqu9IYLq9yL7LUhlTZGAmiu8
server_id
1259016982901293077

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2072	2084	Client-built.exe	30
PID 2084 wrote to memory of 2072	2084	Client-built.exe	30
PID 2084 wrote to memory of 2072	2084	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2084 -s 596
  2⤵
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x000007FEF60E3000-0x000007FEF60E4000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x000000013F060000-0x000000013F078000-memory.dmp

Filesize
96KB

Download
memory/2084-2-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmp

Filesize
9.9MB

Download
memory/2084-3-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmp

Filesize
9.9MB

Download