discordrat | 37d6d9f29987afae8c860a6f3fdd3645e71654fe56d2765a3d9a9310b24597ad | Triage

Resubmissions

30-08-2024 04:19

240830-exp2gaxflr 10

28-08-2024 21:47

240828-1m63wszcjp 10

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 21:47

Sharing

Report Analysis Logs

General

Target

StarPredictorV8.exe
Size

78KB
MD5

6853d172cb6541f87621bee250b872e0
SHA1

be9df9068b361b6ec32d4d12f8c45f14753b10e3
SHA256

37d6d9f29987afae8c860a6f3fdd3645e71654fe56d2765a3d9a9310b24597ad
SHA512

8348ebd28b9683b39ee49aa67625bbe3f126e6e4454ce391d60de072d21964a51e828059ebb30a769c0da28f003a16d2ac087439f6db4c240d9fa00b126b5c3e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+hPIC:5Zv5PDwbjNrmAE+xIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwMjI5NDQyMDg2NzkxMTc0Mg.G_IGPJ.e5G7ZTy7lxD6XVLCjQSUyIfNknmxDjQfb0El_g
server_id
1202294602145468516

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2640	2964	StarPredictorV8.exe	30
PID 2964 wrote to memory of 2640	2964	StarPredictorV8.exe	30
PID 2964 wrote to memory of 2640	2964	StarPredictorV8.exe	30

C:\Users\Admin\AppData\Local\Temp\StarPredictorV8.exe
"C:\Users\Admin\AppData\Local\Temp\StarPredictorV8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2964 -s 596
  2⤵
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x000007FEF4C83000-0x000007FEF4C84000-memory.dmp

Filesize
4KB

Download
memory/2964-1-0x000000013F710000-0x000000013F728000-memory.dmp

Filesize
96KB

Download
memory/2964-2-0x000007FEF4C80000-0x000007FEF566C000-memory.dmp

Filesize
9.9MB

Download
memory/2964-3-0x000007FEF4C80000-0x000007FEF566C000-memory.dmp

Filesize
9.9MB

Download