discordrat | ab89b88da095ccb90bfef2ca1bba709a28bdceceffc41241e21b8fc24ec68ef8 | Triage

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 19:16

Sharing

Report Analysis Logs

General

Target

celestic.exe
Size

78KB
MD5

038faf7b553b5f29ebfa1c000ae225b8
SHA1

de8dd46c92b81dc6e00d61e72612ba81e73a431e
SHA256

ab89b88da095ccb90bfef2ca1bba709a28bdceceffc41241e21b8fc24ec68ef8
SHA512

9c088f152fcf24993830e7696540afd2d50a6540a44f0d8584a5066a984b0e4f32bd0e60cfabadb9696ad048a5fc82616563639ab4bd7d75e75c606f394cca14
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3NDA2MDk5NjEyMTcyMzAzMA.GU7_bO.PQQWKKCz2jDyxsje_hCfYCqcJYeKTnPTcs2E8I
server_id
1274060797798252645

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3004	1520	celestic.exe	30
PID 1520 wrote to memory of 3004	1520	celestic.exe	30
PID 1520 wrote to memory of 3004	1520	celestic.exe	30

C:\Users\Admin\AppData\Local\Temp\celestic.exe
"C:\Users\Admin\AppData\Local\Temp\celestic.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1520 -s 600
  2⤵
  PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/1520-1-0x000000013F920000-0x000000013F938000-memory.dmp

Filesize
96KB

Download
memory/1520-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1520-3-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download