discordrat | c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

Resubmissions

24-11-2024 17:01

241124-vj2q4swkdl 10

26-10-2024 14:16

241026-rlatmawdjq 10

26-10-2024 14:13

241026-rjt5gsvele 10

Analysis

max time kernel
23s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-10-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release/Discord rat.exe
Size

79KB
MD5

d13905e018eb965ded2e28ba0ab257b5
SHA1

6d7fe69566fddc69b33d698591c9a2c70d834858
SHA256

2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512

b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP

1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid	Process
3064	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid	Process
3064	vlc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

vlc.exe

pid	Process
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

vlc.exe

pid	Process
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe
3064	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid	Process
3064	vlc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Discord rat.exe

description	pid	Process	procid_target
PID 2376 wrote to memory of 2588	2376	Discord rat.exe	29
PID 2376 wrote to memory of 2588	2376	Discord rat.exe	29
PID 2376 wrote to memory of 2588	2376	Discord rat.exe	29

C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 596
  2⤵
  PID:2588

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnregisterComplete.mpeg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2376-1-0x000000013FDB0000-0x000000013FDC8000-memory.dmp

Filesize
96KB

Download
memory/2376-2-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2376-3-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/3064-22-0x000007FEFB110000-0x000007FEFB144000-memory.dmp

Filesize
208KB

Download
memory/3064-21-0x000000013FC00000-0x000000013FCF8000-memory.dmp

Filesize
992KB

Download
memory/3064-23-0x000007FEF7CA0000-0x000007FEF7F56000-memory.dmp

Filesize
2.7MB

Download
memory/3064-24-0x000007FEF53B0000-0x000007FEF6460000-memory.dmp

Filesize
16.7MB

Download