discordrat | 09f62ca9ce707a10e1cc29c4e857ae8e38defa05d0f8cc0cad4f84022d6c5b4b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

anton‮gpj.exe
Size

452KB
MD5

bad8e03a0e1cfe746fb77f73ec5042ae
SHA1

4f3bc64ed1e39a3c7e9215a4bd35072052e2a831
SHA256

09f62ca9ce707a10e1cc29c4e857ae8e38defa05d0f8cc0cad4f84022d6c5b4b
SHA512

162e101e05314cb67e855f15fbc4650f909e5df0da8dd13cdb2c1c4d0f7aa1200e705d35fd6f9ab3fb3c7d361994835bdb6cf16f1e3415ccceffe87ca2641ba2
SSDEEP

6144:2E9yzJpeQF2ZcbTzHznY8XHyldgaPGr++7+EK/zJDi3RC4AQNMIoYrmLU8YchJtd:PyveQB/fTHIGaPkKEYzURNAwbAg8YchB

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MjQ3NTk0MjgzMjM3Mzc4MA.Gm3A78.SvvnKqIpnEdUSKBmPvoekRlb-Nq9n0i0njcYUY
server_id
1262476292713087037

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
2884	client-built.exe

Loads dropped DLL 6 IoCs

pid	Process
2120	anton‮gpj.exe
2568	WerFault.exe
2568	WerFault.exe
2568	WerFault.exe
2568	WerFault.exe
2568	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2884	2120	anton‮gpj.exe	32
PID 2120 wrote to memory of 2884	2120	anton‮gpj.exe	32
PID 2120 wrote to memory of 2884	2120	anton‮gpj.exe	32
PID 2884 wrote to memory of 2568	2884	client-built.exe	33
PID 2884 wrote to memory of 2568	2884	client-built.exe	33
PID 2884 wrote to memory of 2568	2884	client-built.exe	33

C:\Users\Admin\AppData\Local\Temp\anton‮gpj.exe
"C:\Users\Admin\AppData\Local\Temp\anton‮gpj.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2884 -s 596
    3⤵
    - Loads dropped DLL
    PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
78KB

MD5
aaa6d8518ecd261b612b93ca39eba34c

SHA1
0ce021ca4d0586c5279cea4c1e10452d3d45038c

SHA256
b2fcabcfa258a6fc509dba4787305e5b995e81f9180297490be1d5196aeb7756

SHA512
2bf2df7055e67bed39f378601fd4de5bf6af2fe4711e3962ecc6f17348e27dcf6152d02b1253bdb89918586aa09e781cd6aadfc66dc3b9a68dc4603bdb986add

Download Submit
memory/2120-6-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/2884-13-0x000007FEF5593000-0x000007FEF5594000-memory.dmp

Filesize
4KB

Download
memory/2884-14-0x000000013F280000-0x000000013F298000-memory.dmp

Filesize
96KB

Download
memory/2884-19-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download
memory/2884-21-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download