discordrat | 14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe
Size

761KB
MD5

71f5e9237f4f6d09e58095147d2bfeb8
SHA1

82059dd096fd1626fdd3dcd154e7cf3c0afffb52
SHA256

14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27
SHA512

03bda8b5316460c1c273719935968cd57a20a25ba7b80767da16210625fba656451bfc35c58908af5b48c7abbb49a97315a5e64c17b69002d34a0ef3f58c93a3
SSDEEP

12288:fzxzTDWikLSb4NS7H+7HX/OQvz/ZTKCbgA0IyuXX:dDWHSb4Nn7POsz/ZT5gFIycX

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwNDYyNDM2OTY0OTg1MjUxOA.Gyboi1.3R0hC9ZYxTw5CzGRoFtSRbIV3eEcPNOM7wQf0E
server_id
1204622844772753458

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe

Executes dropped EXE 1 IoCs

Processes:

screenshot.exe

pid	Process
708	screenshot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

screenshot.exe

description	pid	Process
Token: SeDebugPrivilege	708	screenshot.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe

description	pid	Process	procid_target
PID 3632 wrote to memory of 708	3632	14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe	86
PID 3632 wrote to memory of 708	3632	14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe	86

C:\Users\Admin\AppData\Local\Temp\14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe
"C:\Users\Admin\AppData\Local\Temp\14ab1780c89dd769a95c964cc6bf152514034a2ffc55a4305ff5e71719b75c27.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\screenshot.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\screenshot.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\screenshot.exe

Filesize
283KB

MD5
61a83f0d9735ef5c3e791b6276f2af88

SHA1
1ad8a991831c6e54cd3c0559a260cdb8a00080e9

SHA256
63beccc8ba651113097146ad326e516d30e117bbd41162c304ed0165f239091c

SHA512
e17565ff6c0ddb1f697d02b51e4cab19956a933ddf8ee458ced8a0f083ae16cb3b520c35a29daf81ac8817b624f95a652009011921806a52bf503370e704500f

Download Submit
memory/708-14-0x00007FFDDEA73000-0x00007FFDDEA75000-memory.dmp

Filesize
8KB

Download
memory/708-15-0x0000017AEDC60000-0x0000017AEDCAA000-memory.dmp

Filesize
296KB

Download
memory/708-16-0x0000017AF0380000-0x0000017AF0542000-memory.dmp

Filesize
1.8MB

Download
memory/708-17-0x00007FFDDEA70000-0x00007FFDDF531000-memory.dmp

Filesize
10.8MB

Download
memory/708-18-0x0000017AF0B80000-0x0000017AF10A8000-memory.dmp

Filesize
5.2MB

Download
memory/708-19-0x00007FFDDEA73000-0x00007FFDDEA75000-memory.dmp

Filesize
8KB

Download
memory/708-20-0x00007FFDDEA70000-0x00007FFDDF531000-memory.dmp

Filesize
10.8MB

Download