discordrat | 02917478d399eaf08762d2c2a5a28624822f7478e6ce83610a1b38854f77b841 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 17:30

Sharing

Report Analysis Logs

General

Target

x48v2.exe
Size

78KB
MD5

5537d017f89dce852f3078fb480d62c0
SHA1

1b99bb95dbec6d7b9fdee4b9287732f750884223
SHA256

02917478d399eaf08762d2c2a5a28624822f7478e6ce83610a1b38854f77b841
SHA512

d717d710a9285750e310a41730c09f0f15046320d8feedf9770ad98692a5554361df92758a7abe6b33f90179c4fa1044bf4095248f1c51d4b002a8a16be5664c
SSDEEP

1536:u2WjO8XeEXFF5P7v88wbjNrfxCXhRoKV6+V+8PIC:uZr5PDwbjNrmAE+wIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
https://discord.com/oauth2/authorize?client_id=1290255191228153948&permissions=8&integration_type=0&scope=bot+applications.commands
server_id
1290255874526543882

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2724	2112	x48v2.exe	30
PID 2112 wrote to memory of 2724	2112	x48v2.exe	30
PID 2112 wrote to memory of 2724	2112	x48v2.exe	30

C:\Users\Admin\AppData\Local\Temp\x48v2.exe
"C:\Users\Admin\AppData\Local\Temp\x48v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 596
  2⤵
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x000000013F9B0000-0x000000013F9C8000-memory.dmp

Filesize
96KB

Download
memory/2112-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download