Malware Analysis Report

2024-11-16 13:02

Sample ID 240907-ap437svhmb
Target Client-built.exe
SHA256 d9f31b6c8b884988ba6c59fd1ddd2da1e8bb52879ce8ac54076665287ecd1618
Tags
discordrat persistence rat rootkit stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d9f31b6c8b884988ba6c59fd1ddd2da1e8bb52879ce8ac54076665287ecd1618

Threat Level: Known bad

The file Client-built.exe was found to be: Known bad.

Malicious Activity Summary

discordrat persistence rat rootkit stealer

Discord RAT

Discordrat family

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-09-07 00:24

Signatures

Discordrat family

discordrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-07 00:24

Reported

2024-09-07 00:26

Platform

win7-20240704-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1976 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\system32\WerFault.exe
PID 1976 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\system32\WerFault.exe
PID 1976 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client-built.exe

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1976 -s 596

Network

N/A

Files

memory/1976-0-0x000007FEF65A3000-0x000007FEF65A4000-memory.dmp

memory/1976-1-0x000000013FA10000-0x000000013FA28000-memory.dmp

memory/1976-2-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

memory/1976-3-0x000007FEF65A3000-0x000007FEF65A4000-memory.dmp

memory/1976-4-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-07 00:24

Reported

2024-09-07 00:24

Platform

win10v2004-20240802-en

Max time kernel

7s

Max time network

4s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Client-built.exe

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.134.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 234.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

memory/4804-0-0x00007FF8BD7B3000-0x00007FF8BD7B5000-memory.dmp

memory/4804-1-0x0000018A42E80000-0x0000018A42E98000-memory.dmp

memory/4804-2-0x0000018A5D4E0000-0x0000018A5D6A2000-memory.dmp

memory/4804-3-0x00007FF8BD7B0000-0x00007FF8BE271000-memory.dmp

memory/4804-4-0x0000018A5DCE0000-0x0000018A5E208000-memory.dmp