discordrat | 71db60d88dc44bd9cccadd4f453677d22f630b39c8df60dd5c963029abd9d28e

General

Target

MultiReportV2.exe
Size

78KB
MD5

615e27bbbd17c412275f7eeee8068045
SHA1

7821f9879427a768e11e0b3b8ca1c3bdf1672e03
SHA256

71db60d88dc44bd9cccadd4f453677d22f630b39c8df60dd5c963029abd9d28e
SHA512

692010fe4317aabdc0793bd24214ee84415b9d89449fecf1d92f054250d9298998db999fb173daf94c1ef106ae33c864391b37ea2d0fc69ad4c448583d025254
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+qPIC:5Zv5PDwbjNrmAE+2IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MzM1MTI5MTI1NDUzODI3MQ.GHJbQu.aVoP-1ysFiiieVx91DVEu5VSbH1T5KTqIvcUg4
server_id
1263835750579830847

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

12 discord.com
13 discord.com
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msedge.exe

pid process

4212 msedge.exe
4212 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MultiReportV2.exe

description pid process

Token: SeDebugPrivilege 1620 MultiReportV2.exe

flow	ioc
12	discord.com
13	discord.com

pid	process
4212	msedge.exe
4212	msedge.exe

description	pid	process
Token: SeDebugPrivilege	1620	MultiReportV2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4520 wrote to memory of 2384	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 2384	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4724	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4212	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 4212	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe
PID 4520 wrote to memory of 3224	4520	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\MultiReportV2.exe
"C:\Users\Admin\AppData\Local\Temp\MultiReportV2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8f94f746ha0a8h4b04ha336hca6dc19206c4
1⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff307246f8,0x7fff30724708,0x7fff30724718
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12919072030610844959,12861878772319765809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
2⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12919072030610844959,12861878772319765809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12919072030610844959,12861878772319765809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
2⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
acdedb358bd97fc45cf5230cf8ec0724

SHA1
23674bf1652c4e167cd66ea030d72e0f190ae000

SHA256
c40691ba95966678bb34737b8d484d0208ba2069b91406bbbe7e4637477c067e

SHA512
d153e054c1d99ea773f8651655f425e459c182013d4f239c4edeeeb9de86b559b2ec5c7250efd5019cca951b07af778e99d7ca12fa5e6d4c21ac022647f589b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
886486823449a416a53ff90e0f332623

SHA1
ab9809cebe22e1f79cba35db3ecf9ec83bb6d03b

SHA256
aecc033dba5490f7b2dcb33095b0927714e9ba3d7aec58cbaf5d34edb81e51c7

SHA512
49e9e0c0e0fdc6cdd19f7a28a4378ae61de61026be081716f1d4fe3a51eff95ea50c22d6df947a699f5315abb52f14ed6fb547bf70f206b9cf4607dd9cb4f05d

Download Submit
\??\pipe\LOCAL\crashpad_4520_TXHZFPGLEHTEMFEH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1620-0-0x00007FFF3B173000-0x00007FFF3B175000-memory.dmp

Filesize
8KB

Download
memory/1620-1-0x0000024F682F0000-0x0000024F68308000-memory.dmp

Filesize
96KB

Download
memory/1620-2-0x0000024F6AA10000-0x0000024F6ABD2000-memory.dmp

Filesize
1.8MB

Download
memory/1620-3-0x00007FFF3B170000-0x00007FFF3BC31000-memory.dmp

Filesize
10.8MB

Download
memory/1620-4-0x0000024F6B300000-0x0000024F6B828000-memory.dmp

Filesize
5.2MB

Download
memory/1620-5-0x00007FFF3B173000-0x00007FFF3B175000-memory.dmp

Filesize
8KB

Download
memory/1620-6-0x00007FFF3B170000-0x00007FFF3BC31000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing