discordrat | 85ad2e6790b045addec97dd7ac9d54e3e3995a259c7485f071041708ce57aadf

Resubmissions

15-08-2024 00:20

240815-am97fatfrb 10

05-08-2024 23:15

240805-281cxavhph 10

05-08-2024 23:13

240805-27gjeavhmc 10

Analysis

max time kernel
20s
max time network
23s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cute cat pic.exe
Size

630KB
MD5

830d47eb4e4d55d2b878856445fae249
SHA1

4b80adef867d722fbff2bdede95f7043ebefd2da
SHA256

85ad2e6790b045addec97dd7ac9d54e3e3995a259c7485f071041708ce57aadf
SHA512

9196b47e92756584a70d930ae0f7a48f908cde8ba4762b578efd4545bf48b938c0685cbd372a19553f61f0559cadf5fac771a13d36d29fa2e98355bdb08e755b
SSDEEP

12288:YyveQB/fTHIGaPkKEYzURNAwbAg+fmJNax9Jn2x7n:YuDXTIGaPhEYzUzA0KIs92V

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3MDE1MTU0NDQyNzM4NDk2Mw.GgJHGv.V9KbKHSvwp2eqesQyx1XSS-pmcnaA8qOU-5WRw
server_id
1270152842300100618

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
2768	Client-built.exe

Loads dropped DLL 6 IoCs

pid	Process
1940	Cute cat pic.exe
2908	WerFault.exe
2908	WerFault.exe
2908	WerFault.exe
2908	WerFault.exe
2908	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2768	1940	Cute cat pic.exe	31
PID 1940 wrote to memory of 2768	1940	Cute cat pic.exe	31
PID 1940 wrote to memory of 2768	1940	Cute cat pic.exe	31
PID 2768 wrote to memory of 2908	2768	Client-built.exe	32
PID 2768 wrote to memory of 2908	2768	Client-built.exe	32
PID 2768 wrote to memory of 2908	2768	Client-built.exe	32

C:\Users\Admin\AppData\Local\Temp\Cute cat pic.exe
"C:\Users\Admin\AppData\Local\Temp\Cute cat pic.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2768 -s 596
    3⤵
    - Loads dropped DLL
    PID:2908

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
78KB

MD5
f624b41f3700233cb0ee40676471eac6

SHA1
ab4673251f61de44051107c824467b3612e28aab

SHA256
3dff5f68acbd6683b25b3f5879c9fccc4ada096200e368c4b3fd00a957b9c1f6

SHA512
0e03cf987ce42bee44bd739bcfe957d6c041211b997d6951a84e651a08469b86b29d3ee21e1fae227058089c29c6fdfa465d73d5df547b97f9e2c9ed44286a0d

Download Submit
memory/1940-4-0x0000000002490000-0x00000000024A0000-memory.dmp

Filesize
64KB

Download
memory/2768-11-0x000007FEF5DA3000-0x000007FEF5DA4000-memory.dmp

Filesize
4KB

Download
memory/2768-12-0x000000013FC10000-0x000000013FC28000-memory.dmp

Filesize
96KB

Download
memory/2768-17-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2768-19-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download