discordrat | aa4fd9b40ed3ddf4cb2b38554a3ad0344e11c34a873273bdcfdb053cbbec5057 | Triage

Analysis

max time kernel
21s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 14:42

Sharing

Report Analysis Logs

General

Target

redengine.exe
Size

78KB
MD5

d190aafd5cd1752db1815f4677088807
SHA1

262a4260a8acab24193f307c019104e83b30a858
SHA256

aa4fd9b40ed3ddf4cb2b38554a3ad0344e11c34a873273bdcfdb053cbbec5057
SHA512

4ea0399b0760e6d0a19ad2b15fbd27e21cd86dcd6c64994bbfc3f57a8eeef6a475a37fe9189b44e19b331d4422af7b11dc95f1e9337292ac137137e5f10e24f8
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPIC:5Zv5PDwbjNrmAE+7IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MjA0OTgwODEzOTQyMzc0NA.GaQfYG.7LGcj-W5XtFYi4iORWstYkVS-Wd--pdFC-lFPI
server_id
1262046756489793698

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3032	2056	redengine.exe	30
PID 2056 wrote to memory of 3032	2056	redengine.exe	30
PID 2056 wrote to memory of 3032	2056	redengine.exe	30

C:\Users\Admin\AppData\Local\Temp\redengine.exe
"C:\Users\Admin\AppData\Local\Temp\redengine.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2056 -s 596
  2⤵
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

Filesize
4KB

Download
memory/2056-1-0x000000013F6C0000-0x000000013F6D8000-memory.dmp

Filesize
96KB

Download
memory/2056-2-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/2056-3-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

Filesize
4KB

Download