discordrat | 5f16a9c7859b1a7e1ff26f076dff7197dd837ce8a7f1d52e075459a01c48381d | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 20:57

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

0c293cd0aa86b06c1a976efea41644b1
SHA1

40ff39715953c258eab92d31525a69e124fe63fa
SHA256

5f16a9c7859b1a7e1ff26f076dff7197dd837ce8a7f1d52e075459a01c48381d
SHA512

60f784b9efebe7667b4ac842a71cac8a4d1badcd21c3c9ab3a60355c2425aac6989467c48349b96dde22ab05957f0917498bde29e70a6446e610dbb80bb13964
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5OTQ3NjM2MDE0MTczODEwNA.G8hMss.Newf7HvqfYebdbU57NfSxLCiQR2WOoaKAi70TA
server_id
1299474539683647519

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 1832	2408	Client-built.exe	30
PID 2408 wrote to memory of 1832	2408	Client-built.exe	30
PID 2408 wrote to memory of 1832	2408	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 596
  2⤵
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x000007FEF62E3000-0x000007FEF62E4000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x000000013F950000-0x000000013F968000-memory.dmp

Filesize
96KB

Download
memory/2408-2-0x000007FEF62E0000-0x000007FEF6CCC000-memory.dmp

Filesize
9.9MB

Download
memory/2408-3-0x000007FEF62E0000-0x000007FEF6CCC000-memory.dmp

Filesize
9.9MB

Download