discordrat | 163518d8b2a1bd4061f621c7f51fdfa3aab74b07f3496387c47e851e7875415f | Triage

Resubmissions

08-08-2024 10:13

240808-l87h8asclq 10

07-08-2024 23:44

240807-3raatswekm 10

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-08-2024 10:13

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

c3002dcc38ed19516707eff7c1c06f94
SHA1

d49f86c939d00709af80db2b580dccc709a12fae
SHA256

163518d8b2a1bd4061f621c7f51fdfa3aab74b07f3496387c47e851e7875415f
SHA512

153f56cfcd8b92c1c8288ba23db4185b2403cfc31b2971c9abdff2ae59f5d48be31ea8b5c6d317694ce027d5a9f455e570d71e8f9713c9ecd369a37f0ea8dfd8
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3MDg4OTExODE2MzAxMzYzMg.GjYvfp.-XaaZcCb3L10s9hJGAZTGDQjcowYFXyBTvX-YE
server_id
1270872696850223164

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2016	AUDIODG.EXE
Token: 33	2016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2016	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2584	2268	Client-built.exe	29
PID 2268 wrote to memory of 2584	2268	Client-built.exe	29
PID 2268 wrote to memory of 2584	2268	Client-built.exe	29

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 596
  2⤵
  PID:2584

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2804

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/2268-1-0x000000013F380000-0x000000013F398000-memory.dmp

Filesize
96KB

Download
memory/2268-2-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2268-3-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download