discordrat | 132a57ab50e5d15698b9a99929d0f118cad13f7353eb723daa41e1b853354476 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 15:47

Sharing

Report Analysis Logs

General

Target

Notepad Minecraft.exe
Size

78KB
MD5

38801e10701a6f739024f8e0c7f96d5b
SHA1

264f13f2dd1a5c0a6c680d1f5f590c346547b2fe
SHA256

132a57ab50e5d15698b9a99929d0f118cad13f7353eb723daa41e1b853354476
SHA512

e234044d480e02d99c80a24d50846ec8c870411da2ac725f30309783bc8be589c5bcea70fc43f44db402cf73a63f9a562963107e3367b3090ffda438e567dc8c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+NPIC:5Zv5PDwbjNrmAE+dIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwMTE2OTIzMjM0MDE4OTIxNA.Gys-q1.tKKJx97VdW_Z7GSgMrKzoWfeRvK3AWWfcSFxhc
server_id
1201170015383191592

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2056	2088	Notepad Minecraft.exe	31
PID 2088 wrote to memory of 2056	2088	Notepad Minecraft.exe	31
PID 2088 wrote to memory of 2056	2088	Notepad Minecraft.exe	31

C:\Users\Admin\AppData\Local\Temp\Notepad Minecraft.exe
"C:\Users\Admin\AppData\Local\Temp\Notepad Minecraft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2088 -s 600
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x000000013F900000-0x000000013F918000-memory.dmp

Filesize
96KB

Download
memory/2088-2-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download