discordrat | dc89e0477362f409d4ad88d010d093b755f4b5224847b7d4d52c570aa60f664d | Triage

Resubmissions

13-10-2024 21:16

241013-z4qa2atbjn 10

11-10-2024 22:36

241011-2jc63sxgje 10

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 21:16

Sharing

Report Analysis Logs

General

Target

exe.exe
Size

78KB
MD5

bb4f0729f484bc823bdc393f2fd4b723
SHA1

e7f63627162230106fb2f19c4f349a833cc71cae
SHA256

dc89e0477362f409d4ad88d010d093b755f4b5224847b7d4d52c570aa60f664d
SHA512

e58246f48dcb269838722d182b0e0ab546ee4c92dd8668d10d77eff70b4c4552e9efab8ddfd424319b9cfc84fab08c709f6f7e5ad038ac019c7abeda76b9b946
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4OTk3MDIxNzk1NDU3NDQzNw.GbQkdb.kh74XuJv0Xbq0c4MWWHsA-AkvNHwdvLdF1WM-k
server_id
1289969441831915541

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3064	2132	exe.exe	28
PID 2132 wrote to memory of 3064	2132	exe.exe	28
PID 2132 wrote to memory of 3064	2132	exe.exe	28

C:\Users\Admin\AppData\Local\Temp\exe.exe
"C:\Users\Admin\AppData\Local\Temp\exe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2132 -s 600
  2⤵
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-0-0x000007FEF6363000-0x000007FEF6364000-memory.dmp

Filesize
4KB

Download
memory/2132-1-0x000000013FBD0000-0x000000013FBE8000-memory.dmp

Filesize
96KB

Download
memory/2132-2-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download
memory/2132-3-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download