discordrat | 1632d6243bbdace63217bad0951f5cf94eb1b3d11692f5a681f9476248015a8d

Analysis

max time kernel
29s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YaliMod.exe
Size

503KB
MD5

410fa0138a1dbe162066d3c05f8b7ca3
SHA1

53101738d627e81f95c4c4cf81c6563a307f0226
SHA256

1632d6243bbdace63217bad0951f5cf94eb1b3d11692f5a681f9476248015a8d
SHA512

266bd556ffa3af20e11654cabb1f19d2e6ca0227afb87ef63d2dbe01389a7f3f80b847281229680dc7b44bfa31c691789bcf95ee5b73c31a7f6faadff37d8303
SSDEEP

6144:M9j76xnImFZ1MmF8QTU/urSi38VoXM0qVoXM0n57XGY7wPQRC5uAiIOWO+oYKBIf:0jOtvHMm5xf8VomVoDkYU4RPAKP8J3P

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MDk4NjU1ODQ4ODUxMDUyNQ.GhjU6O.gLCO4YDx_19-HQrbsTjHi1sZ2USHaMsZ0UaAr4
server_id
1260985342689939576

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
2256	YaliModlibDFC.exe

Loads dropped DLL 6 IoCs

pid	Process
2424	YaliMod.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\YaliMod\__tmp_rar_sfx_access_check_259435341	YaliMod.exe
File created	C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe	YaliMod.exe
File opened for modification	C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe	YaliMod.exe
File created	C:\Program Files (x86)\YaliMod\dssdf.bat	YaliMod.exe
File opened for modification	C:\Program Files (x86)\YaliMod\dssdf.bat	YaliMod.exe
File opened for modification	C:\Program Files (x86)\YaliMod	YaliMod.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 11 IoCs

evasion

pid	Process
2904	timeout.exe
2632	timeout.exe
2360	timeout.exe
2924	timeout.exe
2672	timeout.exe
2848	timeout.exe
2680	timeout.exe
2972	timeout.exe
2888	timeout.exe
1260	timeout.exe
2644	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2652	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	tasklist.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	30
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	30
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	30
PID 2424 wrote to memory of 2256	2424	YaliMod.exe	30
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	31
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	31
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	31
PID 2424 wrote to memory of 2340	2424	YaliMod.exe	31
PID 2340 wrote to memory of 2360	2340	cmd.exe	33
PID 2340 wrote to memory of 2360	2340	cmd.exe	33
PID 2340 wrote to memory of 2360	2340	cmd.exe	33
PID 2340 wrote to memory of 2360	2340	cmd.exe	33
PID 2256 wrote to memory of 2772	2256	YaliModlibDFC.exe	34
PID 2256 wrote to memory of 2772	2256	YaliModlibDFC.exe	34
PID 2256 wrote to memory of 2772	2256	YaliModlibDFC.exe	34
PID 2340 wrote to memory of 2972	2340	cmd.exe	36
PID 2340 wrote to memory of 2972	2340	cmd.exe	36
PID 2340 wrote to memory of 2972	2340	cmd.exe	36
PID 2340 wrote to memory of 2972	2340	cmd.exe	36
PID 2340 wrote to memory of 2924	2340	cmd.exe	37
PID 2340 wrote to memory of 2924	2340	cmd.exe	37
PID 2340 wrote to memory of 2924	2340	cmd.exe	37
PID 2340 wrote to memory of 2924	2340	cmd.exe	37
PID 2340 wrote to memory of 2672	2340	cmd.exe	38
PID 2340 wrote to memory of 2672	2340	cmd.exe	38
PID 2340 wrote to memory of 2672	2340	cmd.exe	38
PID 2340 wrote to memory of 2672	2340	cmd.exe	38
PID 2340 wrote to memory of 2848	2340	cmd.exe	39
PID 2340 wrote to memory of 2848	2340	cmd.exe	39
PID 2340 wrote to memory of 2848	2340	cmd.exe	39
PID 2340 wrote to memory of 2848	2340	cmd.exe	39
PID 2340 wrote to memory of 2888	2340	cmd.exe	40
PID 2340 wrote to memory of 2888	2340	cmd.exe	40
PID 2340 wrote to memory of 2888	2340	cmd.exe	40
PID 2340 wrote to memory of 2888	2340	cmd.exe	40
PID 2340 wrote to memory of 2680	2340	cmd.exe	41
PID 2340 wrote to memory of 2680	2340	cmd.exe	41
PID 2340 wrote to memory of 2680	2340	cmd.exe	41
PID 2340 wrote to memory of 2680	2340	cmd.exe	41
PID 2340 wrote to memory of 2904	2340	cmd.exe	42
PID 2340 wrote to memory of 2904	2340	cmd.exe	42
PID 2340 wrote to memory of 2904	2340	cmd.exe	42
PID 2340 wrote to memory of 2904	2340	cmd.exe	42
PID 2340 wrote to memory of 1260	2340	cmd.exe	43
PID 2340 wrote to memory of 1260	2340	cmd.exe	43
PID 2340 wrote to memory of 1260	2340	cmd.exe	43
PID 2340 wrote to memory of 1260	2340	cmd.exe	43
PID 2340 wrote to memory of 2632	2340	cmd.exe	44
PID 2340 wrote to memory of 2632	2340	cmd.exe	44
PID 2340 wrote to memory of 2632	2340	cmd.exe	44
PID 2340 wrote to memory of 2632	2340	cmd.exe	44
PID 2340 wrote to memory of 2644	2340	cmd.exe	45
PID 2340 wrote to memory of 2644	2340	cmd.exe	45
PID 2340 wrote to memory of 2644	2340	cmd.exe	45
PID 2340 wrote to memory of 2644	2340	cmd.exe	45
PID 2340 wrote to memory of 2652	2340	cmd.exe	46
PID 2340 wrote to memory of 2652	2340	cmd.exe	46
PID 2340 wrote to memory of 2652	2340	cmd.exe	46
PID 2340 wrote to memory of 2652	2340	cmd.exe	46
PID 2340 wrote to memory of 2676	2340	cmd.exe	47
PID 2340 wrote to memory of 2676	2340	cmd.exe	47
PID 2340 wrote to memory of 2676	2340	cmd.exe	47
PID 2340 wrote to memory of 2676	2340	cmd.exe	47

C:\Users\Admin\AppData\Local\Temp\YaliMod.exe
"C:\Users\Admin\AppData\Local\Temp\YaliMod.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe
  "C:\Program Files (x86)\YaliMod\YaliModlibDFC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2256 -s 596
    3⤵
    - Loads dropped DLL
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\YaliMod\dssdf.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2360
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2972
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2924
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2672
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2848
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2888
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2680
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2904
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1260
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2632
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2644
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\SysWOW64\find.exe
    find /i "BlueStacks.exe"
    3⤵
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YaliMod\dssdf.bat

Filesize
1KB

MD5
d24aa29426c2cfa8ee6fc40eea509dfb

SHA1
a3192cedd051842f97d55e8ff9a7d456c2295b81

SHA256
91e2614a701394019c5e49fe6b38907839535b88b0f6f8c17bbc4c75b2e5e5a0

SHA512
b1b16efe69b80da5270fead6e50f08e4f0cf992b26efa9b33ffddc246d9a127413d89d418a5ef008ae178f90ff5362964cac5fe1a0b5fcb7c4ddbfd45f2a1c97

Download Submit
\Program Files (x86)\YaliMod\YaliModlibDFC.exe

Filesize
78KB

MD5
c4deffb9e57e61387adb0efb6cc983cc

SHA1
a91f213a57ce52ffa73ffad101aa320e8c66b239

SHA256
24c40e456615ffaa57d5166d8afdb3261c82108c0deac098e62de4c03d120aff

SHA512
3097553057c053dc55892ad26990f51738733ca91fabe3d57db0590491e5f1c34b7871cbbc729eb5a85e0f4e25bf4720b80770d5a6d2a10320ec2b0fe20b25e3

Download Submit
memory/2256-24-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2256-25-0x000000013F770000-0x000000013F788000-memory.dmp

Filesize
96KB

Download