discordrat | c294635103f902bcc9efe1b4ae4ef86b226a657b627fca38e0db840f882dd0a5 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 21:07

Sharing

Report Analysis Logs

General

Target

Roblox-External.exe
Size

78KB
MD5

ab4714df1877b59e511db33d45e27748
SHA1

9361f003225e8d9e6318d21a0ea4c3e8abd28098
SHA256

c294635103f902bcc9efe1b4ae4ef86b226a657b627fca38e0db840f882dd0a5
SHA512

ed18a6e4fa0d430068c7010f82cd315db61a59a1124b73485d605a7ba06a28272a9e75c00455cddfa134fe0877fd913bf708e58514ca96be92235cb8bad8ea04
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NzYzNjQ1NDI5MzcwNDcwNA.GriHoe.5AoWc0NGUyx_i3CgIfNmTychDUDT5RP-vDj-7Q
server_id
1214291005298315345

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Roblox-External.exe

description	pid	process	target process
PID 2184 wrote to memory of 2172	2184	Roblox-External.exe	WerFault.exe
PID 2184 wrote to memory of 2172	2184	Roblox-External.exe	WerFault.exe
PID 2184 wrote to memory of 2172	2184	Roblox-External.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Roblox-External.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox-External.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2184 -s 596
2⤵
PID:2172

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2184-1-0x000000013F460000-0x000000013F478000-memory.dmp

Filesize
96KB

Download
memory/2184-2-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2184-3-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download