discordrat | 1adb49471838431ec8e5ad62abb00c704f32fbac4ee164f4244896e87b9517df | Triage

Analysis

max time kernel
10s
max time network
0s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 18:53

Sharing

Report Analysis Logs

General

Target

Injector.exe
Size

78KB
MD5

75fd32716d11fac29ee671bf4ee672a5
SHA1

62100e776287165121df72222a2dd868012a97fe
SHA256

1adb49471838431ec8e5ad62abb00c704f32fbac4ee164f4244896e87b9517df
SHA512

7a74e89717ba12f9f9209b2c9200f4dbb8623d6ae6e95abdb7a3020cc87960bde7fa16ccb125797fe41a9c92f3eb665050e534b0c4ae341b9cc1993f5660c581
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NjU2ODI5ODA3MDQ3NDc4NQ.Gp9PSJ.9XfORrX7Q0UZ0YFEnibKs_j5b6NOcjXXsqTnyA
server_id
1256297785779556363

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2860	3020	Injector.exe	30
PID 3020 wrote to memory of 2860	3020	Injector.exe	30
PID 3020 wrote to memory of 2860	3020	Injector.exe	30

C:\Users\Admin\AppData\Local\Temp\Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3020 -s 600
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x000007FEF6193000-0x000007FEF6194000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x000000013FEF0000-0x000000013FF08000-memory.dmp

Filesize
96KB

Download
memory/3020-2-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download
memory/3020-3-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

Filesize
9.9MB

Download