discordrat | a94d84583897b4070860f2e044bef6ad4d7333287e2b700a617f366efa4e1ba6 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 21:38

Sharing

Report Analysis Logs

General

Target

9e27fb823d21e228e3dffbc45cb04460N.exe
Size

78KB
MD5

9e27fb823d21e228e3dffbc45cb04460
SHA1

e1a8323c582b310b94e51151c952d055f9f125d2
SHA256

a94d84583897b4070860f2e044bef6ad4d7333287e2b700a617f366efa4e1ba6
SHA512

e453a96523dfdb82fc6efb2e14264712406be68f47f069d5f11cac6bdbf03c950764a0777102f19939770f0390fad9b0e9176f375455ccecead2079ff81a4189
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPIC:5Zv5PDwbjNrmAE+7IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4MjEwMTExOTI0NTM1Mjk3MA.GjBXi5.UIwqZJ7fnilmttJZD9_wZZGmhFwE3Gl_Wm5UDE
server_id
1278318887951400970

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1784	2056	9e27fb823d21e228e3dffbc45cb04460N.exe	30
PID 2056 wrote to memory of 1784	2056	9e27fb823d21e228e3dffbc45cb04460N.exe	30
PID 2056 wrote to memory of 1784	2056	9e27fb823d21e228e3dffbc45cb04460N.exe	30

C:\Users\Admin\AppData\Local\Temp\9e27fb823d21e228e3dffbc45cb04460N.exe
"C:\Users\Admin\AppData\Local\Temp\9e27fb823d21e228e3dffbc45cb04460N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2056 -s 596
  2⤵
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

Filesize
4KB

Download
memory/2056-1-0x000000013FED0000-0x000000013FEE8000-memory.dmp

Filesize
96KB

Download
memory/2056-2-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2056-3-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

Filesize
4KB

Download