discordrat | 62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05

Resubmissions

13-07-2024 18:56

240713-xlsmbsvgmf 10

13-07-2024 18:55

240713-xk64bsvgla 10

13-07-2024 18:41

240713-xbt3eavdjg 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05.exe
Size

78KB
MD5

8dec6d3f32f067bf423a8f51758205c0
SHA1

3542e0d6ba080944a2a981d4fee8e562c06024a7
SHA256

62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05
SHA512

2fcadd0c0704f7e555bbaa320e2009ed52e0f69f2083350322501ab5611fe38564efcc07768075193b821fcbb84b5acedf280c93bff3ba809f4ba0d3e47fbc05
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WPIC:5Zv5PDwbjNrmAE+SIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MTc0MjMwNjM1MzA4NjUxNg.G2U6jS.yFLXk8ETbxjA4Gqs-ERvKABhiVT-LDm936ALSo
server_id
1261079677041381436

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05.exe

description	pid	process	target process
PID 2300 wrote to memory of 2108	2300	62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05.exe	WerFault.exe
PID 2300 wrote to memory of 2108	2300	62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05.exe	WerFault.exe
PID 2300 wrote to memory of 2108	2300	62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05.exe
"C:\Users\Admin\AppData\Local\Temp\62cf53c5a5aab423c58ef6e48bad61cb6f83be949fcdb75f915ff7ad81740c05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2300 -s 596
2⤵
PID:2108

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x000007FEF65A3000-0x000007FEF65A4000-memory.dmp

Filesize
4KB

Download
memory/2300-1-0x000000013FB60000-0x000000013FB78000-memory.dmp

Filesize
96KB

Download
memory/2300-2-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download
memory/2300-3-0x000007FEF65A3000-0x000007FEF65A4000-memory.dmp

Filesize
4KB

Download
memory/2300-4-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download