discordrat | d311fd04604623924d61afe0ffa69eacfc6e25bf84d927f973513071c8c074cb | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 06:17

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

d4adc993c113b97f4c878c71febce4d3
SHA1

9deb50c3b6ba75baa07e7e7e1500990ca677f8ac
SHA256

d311fd04604623924d61afe0ffa69eacfc6e25bf84d927f973513071c8c074cb
SHA512

f6c47b53a92da4c8a69ca1908009614741586c45410334aa0f99e1f1a131b5ffee0527ec7ea8218207f16e7cfeb2c558ed9c2101aae9e02c8d24bbfd0314b8f5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4MjAzMjIzOTc0NzY2NTk0MA.GPc649.bqv1Qp-52Jaq9kMAZZNXa-CNlHUfD5c8_Q9GLY
server_id
1289619296036851775

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 1388 wrote to memory of 2700	1388	Client-built.exe	31
PID 1388 wrote to memory of 2700	1388	Client-built.exe	31
PID 1388 wrote to memory of 2700	1388	Client-built.exe	31

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1388 -s 596
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-0-0x000007FEF5EB3000-0x000007FEF5EB4000-memory.dmp

Filesize
4KB

Download
memory/1388-1-0x000000013FF80000-0x000000013FF98000-memory.dmp

Filesize
96KB

Download
memory/1388-2-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/1388-3-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download