discordrat | 8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 03:21

Sharing

Report Analysis Logs

General

Target

62b838eaddd3d7362dbef4a2c069aab7.exe
Size

78KB
MD5

62b838eaddd3d7362dbef4a2c069aab7
SHA1

dde6f70ab18ea8e519681abc3aaacec36860016b
SHA256

8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb
SHA512

908d4ca659b3754cd95c81913ce4f1364672df33a32f4265483428a4966f32892b302bfdfd00a2e6d6d891c295e0abc1c23f00212308d3490dccefa777352a80
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+tPIC:5Zv5PDwbjNrmAE+9IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1ODg4ODg2MzgxNjg4MDE5MA.GdDEsv.CHlhaZYA9oKA2qnxLBvkKeewJ0GmS5-g775ytQ
server_id
1256282170994196593

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2476	1820	62b838eaddd3d7362dbef4a2c069aab7.exe	30
PID 1820 wrote to memory of 2476	1820	62b838eaddd3d7362dbef4a2c069aab7.exe	30
PID 1820 wrote to memory of 2476	1820	62b838eaddd3d7362dbef4a2c069aab7.exe	30

C:\Users\Admin\AppData\Local\Temp\62b838eaddd3d7362dbef4a2c069aab7.exe
"C:\Users\Admin\AppData\Local\Temp\62b838eaddd3d7362dbef4a2c069aab7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1820 -s 600
  2⤵
  PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/1820-1-0x000000013FD50000-0x000000013FD68000-memory.dmp

Filesize
96KB

Download
memory/1820-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1820-3-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download