discordrat | 9992f57d33f8c2b02abb97575b5879ddbd5e8d9c47d8acf4f1c9a6d1ab00b2b3 | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 09:12

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

fbfe89bba6c1106f17fedb6ad135c1d1
SHA1

d919df9f9520b0d12b59e4b71ba9ed6c04acd1b3
SHA256

9992f57d33f8c2b02abb97575b5879ddbd5e8d9c47d8acf4f1c9a6d1ab00b2b3
SHA512

4f4d476048e68c0c6d83241c1ab3c7e13cf768a562af3aa261c40ed0cbcd31111f428e5d9e58383e03e472165be3decea78a6a2642a9c8a0fa152af634fcf4e1
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5NzExOTY1MTY0OTY4NzYyMw.GgFL6e.EcoB_BGCLAXiApWWRbCXGOCbn_Pwht4J7bc1qA
server_id
1297118742592880710

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 3016 wrote to memory of 2484	3016	Client-built.exe	29
PID 3016 wrote to memory of 2484	3016	Client-built.exe	29
PID 3016 wrote to memory of 2484	3016	Client-built.exe	29

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3016 -s 596
  2⤵
  PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/3016-1-0x000000013F740000-0x000000013F758000-memory.dmp

Filesize
96KB

Download
memory/3016-2-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-3-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download