discordrat | 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec

Resubmissions

08-08-2024 10:36

240808-mna5yssejr 10

07-08-2024 04:52

240807-fhjrks1gmk 10

07-08-2024 04:49

240807-ff5ahavemb 10

07-08-2024 04:33

240807-e6w65svcjg 10

Analysis

max time kernel
92s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-08-2024 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wyd V2.exe
Size

79KB
MD5

d13905e018eb965ded2e28ba0ab257b5
SHA1

6d7fe69566fddc69b33d698591c9a2c70d834858
SHA256

2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512

b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP

1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2944	AUDIODG.EXE
Token: 33	2944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2944	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1132	2308	Wyd V2.exe	30
PID 2308 wrote to memory of 1132	2308	Wyd V2.exe	30
PID 2308 wrote to memory of 1132	2308	Wyd V2.exe	30

C:\Users\Admin\AppData\Local\Temp\Wyd V2.exe
"C:\Users\Admin\AppData\Local\Temp\Wyd V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2308 -s 600
  2⤵
  PID:1132

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\ExitSync.ex_
1⤵
- Modifies registry class
PID:2848

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1a8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x000007FEF5763000-0x000007FEF5764000-memory.dmp

Filesize
4KB

Download
memory/2308-1-0x000000013F810000-0x000000013F828000-memory.dmp

Filesize
96KB

Download
memory/2308-2-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Filesize
9.9MB

Download
memory/2308-3-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Filesize
9.9MB

Download