discordrat | d596f26f338b8476e49c6fb594fbb15e3bb9ad642681da50de2533837a1b377b | Triage

Analysis

max time kernel
13s
max time network
5s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 11:35

Sharing

Report Analysis Logs

General

Target

Loader.exe
Size

78KB
MD5

8cc98f3c08458377e374ae986f81fbe8
SHA1

d78dd2ad26ddd78b888b3d914ea4870744b80e80
SHA256

d596f26f338b8476e49c6fb594fbb15e3bb9ad642681da50de2533837a1b377b
SHA512

0f659139a2140d50583daae2ede3ba3dc1decf6d3e2453b94c15fe389b28fb09667a785c97deb832433751298ee7181b81f6552de9456639fbe3abad7e264f03
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+4PIC:5Zv5PDwbjNrmAE+cIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2NTYzMjgzNDI3MDI2NTQxNQ.G3JE25.C1Gqad5Z4UzXtNvOplKDgT9FICxoWed9r2KVb4
server_id
1055982458186772553

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1048	2556	Loader.exe	29
PID 2556 wrote to memory of 1048	2556	Loader.exe	29
PID 2556 wrote to memory of 1048	2556	Loader.exe	29

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2556 -s 600
  2⤵
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Filesize
4KB

Download
memory/2556-1-0x000000013F6E0000-0x000000013F6F8000-memory.dmp

Filesize
96KB

Download
memory/2556-2-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download
memory/2556-3-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download