discordrat | a0bcb2876aec1eb2173e2f49c3cc1548ce04f38a593ed04d24ff0e3045c0faf6 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 19:49

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

871ec39c515d1e6f6594696404868c50
SHA1

b93d20a7e926b1396be5ba887ae72cdc28cdc101
SHA256

37f79ef934775e7dbcd006be8c438435ffdd059ef4674cee8b988835f5ad2ae9
SHA512

bec7154db76b64ec6ef02164e6959664299ed54fa85d74d7a010d21f2e43e9bcf3b16f9c9fea4c8798325e5e0978d66803014e64342ffbac0cbc2745f7e399ea
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+M/PIC:5Zv5PDwbjNrmAE+MIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4MTE5OTI3Mzg3NDI5Njg2Mg.Go_Acr.HUIHPEQaWjoIWxj4Geox9QLBiEggb5zNfnhqSk
server_id
1276135122353131575

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1892	2276	Client-built.exe	28
PID 2276 wrote to memory of 1892	2276	Client-built.exe	28
PID 2276 wrote to memory of 1892	2276	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2276 -s 600
  2⤵
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x000007FEF5973000-0x000007FEF5974000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x000000013FAE0000-0x000000013FAF8000-memory.dmp

Filesize
96KB

Download
memory/2276-2-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download