discordrat | e69f87dbc38e0ec07e5c6f7952e43325a38e9197d9522092f3746c3dd9a21e43

Analysis

max time kernel
10s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam.exe
Size

522KB
MD5

8ebac9696933022b805e9ac4b384d1da
SHA1

a18168613e61a82d361902f25507ccd3d7387123
SHA256

e69f87dbc38e0ec07e5c6f7952e43325a38e9197d9522092f3746c3dd9a21e43
SHA512

a34e6fd7014574727adaf9c99e0d8504e9416ec7c97273e617318df58d5ee6c0b9d67f1d52888a5d9c5bd1c82146a80142a4d0be5f75ad5adf62c12254fa0747
SSDEEP

12288:ByveQB/fTHIGaPkKEYzURNA/bAg8T9ooF7qp9:BuDXTIGaPhEYzUzATqRoPp9

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzOTc1OTAwMDUyMjk4NTU2Mg.Gh30TZ.Kt1WtrwmuOFPcZGqK_yXxmaFsDK5TpEaOCP4mA
server_id
1239434854953648229

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	Steam.exe

Executes dropped EXE 1 IoCs

pid	Process
4380	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	test.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4380	3068	Steam.exe	84
PID 3068 wrote to memory of 4380	3068	Steam.exe	84

C:\Users\Admin\AppData\Local\Temp\Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Steam.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe

Filesize
78KB

MD5
eb4b07423aac59368f66654b70613f72

SHA1
81aaa9dcc8a80573b4b60a2ea59f336fc5203dd1

SHA256
dbdea6feb5a5be9a97ffbd107de33b602421c469f0c6522aa8acec71d0346b5b

SHA512
173df9d8d947520e40591c8fc216fadfdb63062297dab7052cb1503cc3961c96a718eab5fb81edb629a47988ccb72227dd18fccc6a65f52657b69c8bf4cb2652

Download Submit
memory/4380-14-0x00007FFC73BD3000-0x00007FFC73BD5000-memory.dmp

Filesize
8KB

Download
memory/4380-15-0x0000013FED9F0000-0x0000013FEDA08000-memory.dmp

Filesize
96KB

Download
memory/4380-16-0x0000013FF0090000-0x0000013FF0252000-memory.dmp

Filesize
1.8MB

Download
memory/4380-17-0x00007FFC73BD0000-0x00007FFC74691000-memory.dmp

Filesize
10.8MB

Download
memory/4380-18-0x0000013FF08D0000-0x0000013FF0DF8000-memory.dmp

Filesize
5.2MB

Download