discordrat | 5217cc614036e932a6284d2f8662f706a22a0ca28d5e7b735d339f94c9206fc4 | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:28

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

6c464e8f43e6853a06c928671004813a
SHA1

6a6523ac316ada4437572d4e4f42b8e4e670cce9
SHA256

5217cc614036e932a6284d2f8662f706a22a0ca28d5e7b735d339f94c9206fc4
SHA512

16b6e0fee5b4e56368823f3b17d71f49fbc08f3653589b4ae0c8da417491b795e065af5bd79f2b1b1722ee87cb6b8fd6453957155cdb701703d4a9fad077c8a2
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+3PIC:5Zv5PDwbjNrmAE+/IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MTYxNDM4MjI5NTY4MzExNw.GE_nj2.Ypy15xGPFzqmtY29wDdMyZ-zWy5DnSd1SJEBl8
server_id
1261614095799554139

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2876 wrote to memory of 1812	2876	Client-built.exe	WerFault.exe
PID 2876 wrote to memory of 1812	2876	Client-built.exe	WerFault.exe
PID 2876 wrote to memory of 1812	2876	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2876 -s 596
2⤵
PID:1812

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x000007FEF6013000-0x000007FEF6014000-memory.dmp

Filesize
4KB

Download
memory/2876-1-0x000000013F9B0000-0x000000013F9C8000-memory.dmp

Filesize
96KB

Download
memory/2876-2-0x000007FEF6010000-0x000007FEF69FC000-memory.dmp

Filesize
9.9MB

Download
memory/2876-3-0x000007FEF6010000-0x000007FEF69FC000-memory.dmp

Filesize
9.9MB

Download