discordrat | e95fad48c383d4cb6141266e41b32a12b9f032735860722a56e3b0a8a26947a4 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 18:19

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

57965da87205d09524f25c43ddd5a8ff
SHA1

c588e6247a4fd83d5c3eb84fb7e2c033358bf6a4
SHA256

e95fad48c383d4cb6141266e41b32a12b9f032735860722a56e3b0a8a26947a4
SHA512

5f281a85b6a9179422c36fa6ac35b1318ea7fba70b94628731d302a5b833734f6f028ba90c7c79a0dd040cf21ab4c064fce4d5015740ce00de33186e96194e54
SSDEEP

1536:F2WjO8XeEXFd5P7v88wbjNrfxCXhRoKV6+V+NPIC:FZz5PDwbjNrmAE+dIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
OTEzNTE3MjYxMzY3Njg1MTcw.GePjmr.VME6W32IUR7dGTfUsVa31jmJR3nHBFVSmB952A
server_id
1050840279441215498

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2784	2676	Client-built.exe	31
PID 2676 wrote to memory of 2784	2676	Client-built.exe	31
PID 2676 wrote to memory of 2784	2676	Client-built.exe	31

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2676 -s 600
  2⤵
  PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-0-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x000000013F600000-0x000000013F618000-memory.dmp

Filesize
96KB

Download
memory/2676-2-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download