discordrat | b020c31ce78bdf2200b9dadc61fd7ad0e34e3f9c05cf3724743ca9e58c7bec44 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 07:06

Sharing

Report Analysis Logs

General

Target

0.exe
Size

78KB
MD5

1b9c81334aa2661c3be9bf1a12db2aae
SHA1

7ac337e1eb0adac85cf54a605183b25ba0a12fd4
SHA256

b020c31ce78bdf2200b9dadc61fd7ad0e34e3f9c05cf3724743ca9e58c7bec44
SHA512

73761d06a1945b608eb0c03f3da01149177b342cb2ecb50f9c2aedfce8d34bd1efc309fe13cb5d0ad128247ea9c060ce747f753dbfe2af31a16c729587aebdf9
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZDPIC:5Zv5PDwbjNrmAE+ZbIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4OTU5MTU3OTc0NDY2NTYwMQ.GeVN_G.B9uH1vpClVyq73820fXzo5z7HFsuew0uArUTHU
server_id
1289604307905413142

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2368	808	0.exe	30
PID 808 wrote to memory of 2368	808	0.exe	30
PID 808 wrote to memory of 2368	808	0.exe	30

C:\Users\Admin\AppData\Local\Temp\0.exe
"C:\Users\Admin\AppData\Local\Temp\0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 808 -s 596
  2⤵
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/808-1-0x000000013F8A0000-0x000000013F8B8000-memory.dmp

Filesize
96KB

Download
memory/808-2-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/808-3-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download