discordrat | 73a7fa43ce60a9ed547e29a9841d3d4fa98d3e1cd0a76f0adbf25ecd714e2fbb | Triage

Resubmissions

07-10-2024 05:48

241007-ghjbgsygmk 10

05-10-2024 05:38

241005-gbwm8sybqq 10

Analysis

max time kernel
26s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-10-2024 05:48

Sharing

Report Analysis Logs

General

Target

RobuxGenerator.exe
Size

78KB
MD5

a925d6ec3fbdba8e4026ee5ffabe653d
SHA1

a2d74999bdda2fadaf0aa8b099801167f68e1e39
SHA256

73a7fa43ce60a9ed547e29a9841d3d4fa98d3e1cd0a76f0adbf25ecd714e2fbb
SHA512

90123106e504fd4d96e63f4d36d1c2fdeded6f7b5479672d900ce9eef42aec5e90ced704f138c0a4f64da2eb7773420bcc07d51091c183708d84edabddb56d63
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gdPIC:5Zv5PDwbjNrmAE+gNIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5MDE3NTAxNDM1NTczMDQ3Nw.G-EXaf.BysHjbuehzd47FNQQ3uQiIi6vnESuslp8aw13Q
server_id
1287264152271978496

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

RobuxGenerator.exe

description	pid	Process	procid_target
PID 2192 wrote to memory of 2784	2192	RobuxGenerator.exe	30
PID 2192 wrote to memory of 2784	2192	RobuxGenerator.exe	30
PID 2192 wrote to memory of 2784	2192	RobuxGenerator.exe	30

C:\Users\Admin\AppData\Local\Temp\RobuxGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\RobuxGenerator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 600
  2⤵
  PID:2784

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x000000013F3F0000-0x000000013F408000-memory.dmp

Filesize
96KB

Download
memory/2192-2-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2192-3-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download