discordrat | f1565633b0eecd09d5762442113e5274c4046f6d7757e59be7cdc2d04f08a1fc | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 13:44

Sharing

Report Analysis Logs

General

Target

If U get my token u bitch/SetupV04.exe
Size

78KB
MD5

7a3a1263d2b8099be9c901315f33d96f
SHA1

76dfee6d96b57c9ae42272cad5d0ae9a2521c8cb
SHA256

b4b6f36c6d9f56ebc8a32111f078d01a9a14e401db2f07cea58225b086e322bc
SHA512

d33094071d5d6d36397decb6c1e36bbaa2997e6af3f17285475d1d1c9097b946692438de7e55a9adc2a022dd61bc0c07f087849cfa35837a1b98898905adda8d
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+tPIC:5Zv5PDwbjNrmAE+9IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5Mjg0MzMwMDQ3ODI1NTIxMA.Grp0nq.IltV2goLIM_c10bpfATLRoFvn6NwJdH5SZVh-0
server_id
1295367246914261043

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2972	2704	SetupV04.exe	30
PID 2704 wrote to memory of 2972	2704	SetupV04.exe	30
PID 2704 wrote to memory of 2972	2704	SetupV04.exe	30

C:\Users\Admin\AppData\Local\Temp\If U get my token u bitch\SetupV04.exe
"C:\Users\Admin\AppData\Local\Temp\If U get my token u bitch\SetupV04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2704 -s 596
  2⤵
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-0-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/2704-1-0x000000013FB80000-0x000000013FB98000-memory.dmp

Filesize
96KB

Download
memory/2704-2-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-3-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download