discordrat | 2e924669ad577c661d77a4ff8efd23a9a62efcfd0b499c8a0d741462656dca07 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-10-2024 00:08

Sharing

Report Analysis Logs

General

Target

Yizzy menu 7.2.5.exe
Size

78KB
MD5

cfa4e068f22185a4d0f1d9c14af7b30e
SHA1

7b96e0915773d64350cd5b93bbe85ab4b4d1ab40
SHA256

2e924669ad577c661d77a4ff8efd23a9a62efcfd0b499c8a0d741462656dca07
SHA512

19900d7a08fccbbb56d78c088259028465d4f7f752118bbf099e48ab01904c716ef14c6e1b7e17a97d615730fe9d49dc150e16dae6fdd769120b9693adc58557
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5ODUxNTU4NTMwNjcyNjQ2Mw.Gq0gUl.BFqro27n_tJQUE7N6u3vRu9oztd6vH8x7Wt7MU
server_id
1298515483619753984

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Yizzy menu 7.2.5.exe

description	pid	Process	procid_target
PID 3044 wrote to memory of 2340	3044	Yizzy menu 7.2.5.exe	31
PID 3044 wrote to memory of 2340	3044	Yizzy menu 7.2.5.exe	31
PID 3044 wrote to memory of 2340	3044	Yizzy menu 7.2.5.exe	31

C:\Users\Admin\AppData\Local\Temp\Yizzy menu 7.2.5.exe
"C:\Users\Admin\AppData\Local\Temp\Yizzy menu 7.2.5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 604
  2⤵
  PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x000000013F3C0000-0x000000013F3D8000-memory.dmp

Filesize
96KB

Download
memory/3044-2-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-3-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

Filesize
9.9MB

Download