discordrat | 5f16a9c7859b1a7e1ff26f076dff7197dd837ce8a7f1d52e075459a01c48381d | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 20:58

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

0c293cd0aa86b06c1a976efea41644b1
SHA1

40ff39715953c258eab92d31525a69e124fe63fa
SHA256

5f16a9c7859b1a7e1ff26f076dff7197dd837ce8a7f1d52e075459a01c48381d
SHA512

60f784b9efebe7667b4ac842a71cac8a4d1badcd21c3c9ab3a60355c2425aac6989467c48349b96dde22ab05957f0917498bde29e70a6446e610dbb80bb13964
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5OTQ3NjM2MDE0MTczODEwNA.G8hMss.Newf7HvqfYebdbU57NfSxLCiQR2WOoaKAi70TA
server_id
1299474539683647519

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 2760 wrote to memory of 3028	2760	Client-built.exe	30
PID 2760 wrote to memory of 3028	2760	Client-built.exe	30
PID 2760 wrote to memory of 3028	2760	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2760 -s 600
  2⤵
  PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x000007FEF6783000-0x000007FEF6784000-memory.dmp

Filesize
4KB

Download
memory/2760-1-0x000000013F1B0000-0x000000013F1C8000-memory.dmp

Filesize
96KB

Download
memory/2760-2-0x000007FEF6780000-0x000007FEF716C000-memory.dmp

Filesize
9.9MB

Download
memory/2760-3-0x000007FEF6780000-0x000007FEF716C000-memory.dmp

Filesize
9.9MB

Download