discordrat | 1632d6243bbdace63217bad0951f5cf94eb1b3d11692f5a681f9476248015a8d

General

Target

YaliMod.exe
Size

503KB
MD5

410fa0138a1dbe162066d3c05f8b7ca3
SHA1

53101738d627e81f95c4c4cf81c6563a307f0226
SHA256

1632d6243bbdace63217bad0951f5cf94eb1b3d11692f5a681f9476248015a8d
SHA512

266bd556ffa3af20e11654cabb1f19d2e6ca0227afb87ef63d2dbe01389a7f3f80b847281229680dc7b44bfa31c691789bcf95ee5b73c31a7f6faadff37d8303
SSDEEP

6144:M9j76xnImFZ1MmF8QTU/urSi38VoXM0qVoXM0n57XGY7wPQRC5uAiIOWO+oYKBIf:0jOtvHMm5xf8VomVoDkYU4RPAKP8J3P

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MDk4NjU1ODQ4ODUxMDUyNQ.GhjU6O.gLCO4YDx_19-HQrbsTjHi1sZ2USHaMsZ0UaAr4
server_id
1260985342689939576

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Executes dropped EXE 1 IoCs

Processes:

YaliModlibDFC.exe

pid process

2256 YaliModlibDFC.exe
Loads dropped DLL 6 IoCs

Processes:

YaliMod.exeWerFault.exe

pid process

2424 YaliMod.exe
2772 WerFault.exe
2772 WerFault.exe
2772 WerFault.exe
2772 WerFault.exe
2772 WerFault.exe

pid	process
2256	YaliModlibDFC.exe

pid	process
2424	YaliMod.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe

Drops file in Program Files directory 6 IoCs

Processes:

YaliMod.exe

description	ioc	process
File created	C:\Program Files (x86)\YaliMod\__tmp_rar_sfx_access_check_259435341	YaliMod.exe
File created	C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe	YaliMod.exe
File opened for modification	C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe	YaliMod.exe
File created	C:\Program Files (x86)\YaliMod\dssdf.bat	YaliMod.exe
File opened for modification	C:\Program Files (x86)\YaliMod\dssdf.bat	YaliMod.exe
File opened for modification	C:\Program Files (x86)\YaliMod	YaliMod.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 11 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
2904	timeout.exe
2632	timeout.exe
2360	timeout.exe
2924	timeout.exe
2672	timeout.exe
2848	timeout.exe
2680	timeout.exe
2972	timeout.exe
2888	timeout.exe
1260	timeout.exe
2644	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2652 tasklist.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tasklist.exe

description pid process

Token: SeDebugPrivilege 2652 tasklist.exe

pid	process
2652	tasklist.exe

description	pid	process
Token: SeDebugPrivilege	2652	tasklist.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

YaliMod.execmd.exeYaliModlibDFC.exe

description	pid	process	target process
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	YaliModlibDFC.exe
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	YaliModlibDFC.exe
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	YaliModlibDFC.exe
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	YaliModlibDFC.exe
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	cmd.exe
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	cmd.exe
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	cmd.exe
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	cmd.exe
PID 2340 wrote to memory of 2360	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2360	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2360	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2360	2340	cmd.exe	timeout.exe
PID 2256 wrote to memory of 2772	2256	YaliModlibDFC.exe	WerFault.exe
PID 2256 wrote to memory of 2772	2256	YaliModlibDFC.exe	WerFault.exe
PID 2256 wrote to memory of 2772	2256	YaliModlibDFC.exe	WerFault.exe
PID 2340 wrote to memory of 2972	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2972	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2972	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2972	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2924	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2924	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2924	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2924	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2672	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2672	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2672	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2672	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2848	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2848	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2848	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2848	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2888	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2888	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2888	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2888	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2680	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2680	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2680	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2680	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2904	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2904	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2904	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2904	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 1260	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 1260	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 1260	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 1260	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2632	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2632	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2632	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2632	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2644	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2644	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2644	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2644	2340	cmd.exe	timeout.exe
PID 2340 wrote to memory of 2652	2340	cmd.exe	tasklist.exe
PID 2340 wrote to memory of 2652	2340	cmd.exe	tasklist.exe
PID 2340 wrote to memory of 2652	2340	cmd.exe	tasklist.exe
PID 2340 wrote to memory of 2652	2340	cmd.exe	tasklist.exe
PID 2340 wrote to memory of 2676	2340	cmd.exe	find.exe
PID 2340 wrote to memory of 2676	2340	cmd.exe	find.exe
PID 2340 wrote to memory of 2676	2340	cmd.exe	find.exe
PID 2340 wrote to memory of 2676	2340	cmd.exe	find.exe

C:\Users\Admin\AppData\Local\Temp\YaliMod.exe
"C:\Users\Admin\AppData\Local\Temp\YaliMod.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2424

C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe
"C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2256 -s 596
3⤵
- Loads dropped DLL
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files (x86)\YaliMod\dssdf.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\timeout.exe
timeout /t 3 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2360

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2972

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2924

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2672

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2848

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2888

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2680

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2904

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:1260

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2632

C:\Windows\SysWOW64\timeout.exe
timeout /t 1 /nobreak
3⤵
- Delays execution with timeout.exe
PID:2644

C:\Windows\SysWOW64\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\SysWOW64\find.exe
find /i "BlueStacks.exe"
3⤵
PID:2676

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Process Discovery

1

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YaliMod\dssdf.bat
Filesize
1KB

MD5
d24aa29426c2cfa8ee6fc40eea509dfb

SHA1
a3192cedd051842f97d55e8ff9a7d456c2295b81

SHA256
91e2614a701394019c5e49fe6b38907839535b88b0f6f8c17bbc4c75b2e5e5a0

SHA512
b1b16efe69b80da5270fead6e50f08e4f0cf992b26efa9b33ffddc246d9a127413d89d418a5ef008ae178f90ff5362964cac5fe1a0b5fcb7c4ddbfd45f2a1c97

Download Submit
\Program Files (x86)\YaliMod\YaliModlibDFC.exe
Filesize
78KB

MD5
c4deffb9e57e61387adb0efb6cc983cc

SHA1
a91f213a57ce52ffa73ffad101aa320e8c66b239

SHA256
24c40e456615ffaa57d5166d8afdb3261c82108c0deac098e62de4c03d120aff

SHA512
3097553057c053dc55892ad26990f51738733ca91fabe3d57db0590491e5f1c34b7871cbbc729eb5a85e0f4e25bf4720b80770d5a6d2a10320ec2b0fe20b25e3

Download Submit
memory/2256-24-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2256-25-0x000000013F770000-0x000000013F788000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads