discordrat | 2e924669ad577c661d77a4ff8efd23a9a62efcfd0b499c8a0d741462656dca07 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/10/2024, 05:25

Sharing

Report Analysis Logs

General

Target

Yizzymenu7.2.5.exe
Size

78KB
MD5

cfa4e068f22185a4d0f1d9c14af7b30e
SHA1

7b96e0915773d64350cd5b93bbe85ab4b4d1ab40
SHA256

2e924669ad577c661d77a4ff8efd23a9a62efcfd0b499c8a0d741462656dca07
SHA512

19900d7a08fccbbb56d78c088259028465d4f7f752118bbf099e48ab01904c716ef14c6e1b7e17a97d615730fe9d49dc150e16dae6fdd769120b9693adc58557
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5ODUxNTU4NTMwNjcyNjQ2Mw.Gq0gUl.BFqro27n_tJQUE7N6u3vRu9oztd6vH8x7Wt7MU
server_id
1298515483619753984

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2140	2960	Yizzymenu7.2.5.exe	28
PID 2960 wrote to memory of 2140	2960	Yizzymenu7.2.5.exe	28
PID 2960 wrote to memory of 2140	2960	Yizzymenu7.2.5.exe	28

C:\Users\Admin\AppData\Local\Temp\Yizzymenu7.2.5.exe
"C:\Users\Admin\AppData\Local\Temp\Yizzymenu7.2.5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2960 -s 600
  2⤵
  PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/2960-1-0x000000013F960000-0x000000013F978000-memory.dmp

Filesize
96KB

Download
memory/2960-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-3-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download