discordrat | 1c8b0bc47959a8a4ccf8f4fb503a4140e64c061b6caab1e7b928c57c8b384626 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 11:43

Sharing

Report Analysis Logs

General

Target

BypasserBootstrapper.exe
Size

78KB
MD5

7034301e3ac031e461bac41724e99e6a
SHA1

7bd734437f0b19c7747aba31052c483435daa752
SHA256

1c8b0bc47959a8a4ccf8f4fb503a4140e64c061b6caab1e7b928c57c8b384626
SHA512

08d372de93dc286e4cbb92985accec6bbe05d303a4b3bdfbfc8f9a52e32c53290f25559d2d2c1647f5b8f6eed3784847e8bbcaa8a6a7076a45c91ab1dce7bc39
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5Njc5NzcxODY3NjUwODcxMg.GrzRRI.D-De87vmLBpcyR4TeswbQ1RxxK-0yfr_6Sp90Y
server_id
1296796257108365374

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2428	2520	BypasserBootstrapper.exe	30
PID 2520 wrote to memory of 2428	2520	BypasserBootstrapper.exe	30
PID 2520 wrote to memory of 2428	2520	BypasserBootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\BypasserBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\BypasserBootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 600
  2⤵
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/2520-1-0x000000013FE10000-0x000000013FE28000-memory.dmp

Filesize
96KB

Download
memory/2520-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/2520-3-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download