discordrat | 1ad5599d212ff553f0751bb096c25e3cdb89b5e938e963851c7ca6dd4135476c | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 20:19

Sharing

Report Analysis Logs

General

Target

FeatherB/FeatherBootstrapper.exe
Size

78KB
MD5

48d390347ce93ca2b34917da729c3006
SHA1

65104157ce6d62d4ac7c723bc5c4a2620c2aefbb
SHA256

cb9269ed714f14dbabd2df4f2dd0af7e686ff178470bb2189a6d35a7f42b5efa
SHA512

f68e1e253055988019b830cf37af69c67271904eb989b972bdcb2edfbc67e964b85c7d3e510ad19287ed74073e75759c4fa4a2fff0f35bf7fb09bcd09c3627dd
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2Mjc3ODU4MTgxNDIxNDc3Ng.GoRPys._68wmafo5T8UikhKXH678wKMr5nwbtLkTb_XXI
server_id
1262984138315530440

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1792	2860	FeatherBootstrapper.exe	30
PID 2860 wrote to memory of 1792	2860	FeatherBootstrapper.exe	30
PID 2860 wrote to memory of 1792	2860	FeatherBootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\FeatherB\FeatherBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\FeatherB\FeatherBootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2860 -s 596
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/2860-1-0x000000013FF20000-0x000000013FF38000-memory.dmp

Filesize
96KB

Download
memory/2860-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2860-3-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download