discordrat | 5f037f6aa2a4f018d462a0b636bbce9ee0c5df16e2d4a7535e0b0539c19ef772 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 23:34

Sharing

Report Analysis Logs

General

Target

Yizzymenu3.PNMu_O27.5.0.exe
Size

78KB
MD5

1c89810efb6940a313a1c4fe4dc0becf
SHA1

c24f3be128e54d65bc4a0307c2b6b7fe15a7ef02
SHA256

5f037f6aa2a4f018d462a0b636bbce9ee0c5df16e2d4a7535e0b0539c19ef772
SHA512

c4f92971ef66215b415a7d3c1de433dbec63c9f9d9e26c8822b3dc2041939e9a95c72f80274d3995d452a4567ca208cc8434fe6ce0c65af5c443860f12138eac
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+hPIC:5Zv5PDwbjNrmAE+xIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5NDg3MDQ2MDkzMjI5Njg0Ng.GN6Nk1.90eLf8IhopBLV0mFSsHaYOzQGeDi8ASxB0uhPo
server_id
1294871305002160199

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Yizzymenu3.PNMu_O27.5.0.exe

description	pid	Process	procid_target
PID 2184 wrote to memory of 1680	2184	Yizzymenu3.PNMu_O27.5.0.exe	28
PID 2184 wrote to memory of 1680	2184	Yizzymenu3.PNMu_O27.5.0.exe	28
PID 2184 wrote to memory of 1680	2184	Yizzymenu3.PNMu_O27.5.0.exe	28

C:\Users\Admin\AppData\Local\Temp\Yizzymenu3.PNMu_O27.5.0.exe
"C:\Users\Admin\AppData\Local\Temp\Yizzymenu3.PNMu_O27.5.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2184 -s 600
  2⤵
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/2184-1-0x000000013F3C0000-0x000000013F3D8000-memory.dmp

Filesize
96KB

Download
memory/2184-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2184-3-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download