discordrat | 1dc198dac7457cef64f8df0ac5278d825f555372a155592e4044f2568cb22f3c | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 14:28

Sharing

Report Analysis Logs

General

Target

installer.exe
Size

78KB
MD5

7d86cff436224fa7694363b373e8fb75
SHA1

25284f1fb1fdc4a118e708a6fbb657034f7b4145
SHA256

1dc198dac7457cef64f8df0ac5278d825f555372a155592e4044f2568cb22f3c
SHA512

e7136dc22e6864b7205d449c952ebe9b126a1070bfef2b9443d8fb7fa97f2a9b12dc8b1060b2d2c4aa67de3831a1288c7c379a3c173f3c28130e7f39e14c31f2
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++YPIC:5Zv5PDwbjNrmAE++8IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MDY3MjEyMjk5NzcwMjc1OA.GMvjGS.Rr3yatRVdaro59R_wZuLmLGX8LSpylIuuIbfCY
server_id
1260672247937499186

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2928	2764	installer.exe	30
PID 2764 wrote to memory of 2928	2764	installer.exe	30
PID 2764 wrote to memory of 2928	2764	installer.exe	30

C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2764 -s 596
  2⤵
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download
memory/2764-1-0x000000013F7B0000-0x000000013F7C8000-memory.dmp

Filesize
96KB

Download
memory/2764-2-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-3-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download