discordrat | d38d52777b043c46f4f241c8a1eeda0d08b12505e25a8c1a397510a2ef4a56df | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 15:17

Sharing

Report Analysis Logs

General

Target

ImageLoggerV11.exe
Size

78KB
MD5

d47e60cdf412679d941d7b856de3c03b
SHA1

cf691f86748de092b9cc53e7b8dea2bbf93b5882
SHA256

d38d52777b043c46f4f241c8a1eeda0d08b12505e25a8c1a397510a2ef4a56df
SHA512

930dee3eaafbd97ca4f0e532232dd335924951cc15dc7869f7202b21906ad5648d77f98668020ea504462aecad268b61b47c1235e35c07ee5cfb0de227bf7498
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4MjMzMjU4Njg1MjYxODMxMw.GVoFcd.wdWPIpLUemPy5G5hca2UTsOqgZ9t0eCcUCVik8
server_id
1282332626874794170

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2272	796	ImageLoggerV11.exe	28
PID 796 wrote to memory of 2272	796	ImageLoggerV11.exe	28
PID 796 wrote to memory of 2272	796	ImageLoggerV11.exe	28

C:\Users\Admin\AppData\Local\Temp\ImageLoggerV11.exe
"C:\Users\Admin\AppData\Local\Temp\ImageLoggerV11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 796 -s 600
  2⤵
  PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-0-0x000007FEF5423000-0x000007FEF5424000-memory.dmp

Filesize
4KB

Download
memory/796-1-0x000000013F770000-0x000000013F788000-memory.dmp

Filesize
96KB

Download
memory/796-2-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

Filesize
9.9MB

Download
memory/796-3-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

Filesize
9.9MB

Download