discordrat | a8586827f1bc5d022d82a304a9e91ecddf43c8f304afa92c9834c46ec28b58e0 | Triage

Analysis

max time kernel
838s
max time network
849s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 14:18

Sharing

Report Analysis Logs

General

Target

qweqweqweqw-main/Client-built.exe
Size

78KB
MD5

9ec096031265bcb05e5387e82168c0b3
SHA1

73f06cf2f83ea34948ed7abc1efdb7a56eb5dbe3
SHA256

4e1fbc130ebfb635bc7ab358ac8d9eee9ed9225359f01d1c01fb29e29d8ef9bd
SHA512

56b95d7644975ec6e77b2baa6031707111aad41c908e557f75bec60a652432d3a5a9f07ead71631a7f4a9f303d587996b0319cfc597d6d98f582452d242c27c7
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+u6PIC:5Zv5PDwbjNrmAE+umIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NjMyMjA1MjI4NjA1ODU4MQ.GXaTOL.L1Bde1kmFmXuyZ3LK4kGy4Ab9YhMt8b3KUVyNU
server_id
1174076539189612677

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2676 wrote to memory of 2128	2676	Client-built.exe	WerFault.exe
PID 2676 wrote to memory of 2128	2676	Client-built.exe	WerFault.exe
PID 2676 wrote to memory of 2128	2676	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\qweqweqweqw-main\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\qweqweqweqw-main\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2676 -s 600
2⤵
PID:2128

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-2-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2676-1-0x000000013F850000-0x000000013F868000-memory.dmp

Filesize
96KB

Download
memory/2676-0-0x000007FEF5463000-0x000007FEF5464000-memory.dmp

Filesize
4KB

Download
memory/2676-3-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download