discordrat | 22f00720022566cd951ea2b7493fb6438bccffdb2bc8fa76231314b308a64a67 | Triage

Resubmissions

08-07-2024 08:18

240708-j7c7wazgnp 10

08-07-2024 08:14

240708-j4ypeazfpp 10

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 08:14

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

78KB
MD5

76c5a990442f96d793cdf5145dbe638c
SHA1

ba4536aa1a96d3e1cbb6303a259029cbdf55d42b
SHA256

22f00720022566cd951ea2b7493fb6438bccffdb2bc8fa76231314b308a64a67
SHA512

2e72b9950499ef35807f458122339494b7004a91c563f7eafd7fb87510a895a72ab06f7ec3aed0ab2c20a918813c6cd45a7b899b4483a720616418e2872f8700
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+GUPIC:5Zv5PDwbjNrmAE+GIIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1OTc1MzM2OTYwNjU1Nzc4Nw.GCDjnU.jDuoqMFNc69xbYCpCnnlYm4Tgg5IeLLwnj3hr0
server_id
1259782106599522305

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 2176 wrote to memory of 1748	2176	Setup.exe	WerFault.exe
PID 2176 wrote to memory of 1748	2176	Setup.exe	WerFault.exe
PID 2176 wrote to memory of 1748	2176	Setup.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2176 -s 596
2⤵
PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x000007FEF5F63000-0x000007FEF5F64000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x000000013F420000-0x000000013F438000-memory.dmp

Filesize
96KB

Download
memory/2176-2-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

Filesize
9.9MB

Download
memory/2176-3-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

Filesize
9.9MB

Download