discordrat | 126d3abd2382378833b22df594d176fbf08223e9dc3679364bc46ac835296323 | Triage

Resubmissions

06-08-2024 12:10

240806-pb7dqssfmb 10

26-07-2024 17:58

240726-wj74kavdlp 10

26-07-2024 01:45

240726-b6f85sycrr 10

Analysis

max time kernel
20s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 17:58

Sharing

Report Analysis Logs

General

Target

sigma.exe
Size

78KB
MD5

1b29c01dc26295000d69aa5237e9ea95
SHA1

34d81d53e28031c4d5f0a5d1e1d85390fc6b339e
SHA256

126d3abd2382378833b22df594d176fbf08223e9dc3679364bc46ac835296323
SHA512

273013ff15cab03072afb33946688785f28d261e19ce5fde890035e0b8900e53b9642d7fe2cf9c3799dbfb73ac1d4a3508c5b3f8752a5bc877212ad181254fad
SSDEEP

1536:/2WjO8XeEXFi5P7v88wbjNrfxCXhRoKV6+V+NPIC:/Zs5PDwbjNrmAE+dIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
1168063029754216448
server_id
1168062993934852176

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2172	1976	sigma.exe	31
PID 1976 wrote to memory of 2172	1976	sigma.exe	31
PID 1976 wrote to memory of 2172	1976	sigma.exe	31

C:\Users\Admin\AppData\Local\Temp\sigma.exe
"C:\Users\Admin\AppData\Local\Temp\sigma.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1976 -s 596
  2⤵
  PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/1976-1-0x000000013F830000-0x000000013F848000-memory.dmp

Filesize
96KB

Download
memory/1976-2-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-3-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download