discordrat | e3e46f0d836d7536b5f14324d34ffe38fc337a9c09fbf0429fdd9fe82d1e1ba4 | Triage

Resubmissions

02-11-2024 17:27

241102-v1kh6atlen 10

02-11-2024 11:48

241102-nypxjawmbp 10

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 11:48

Sharing

Report Analysis Logs

General

Target

ZoraraUI.exe
Size

95KB
MD5

57114b780ad5cf03a23b897a7ee3ed50
SHA1

871313b421dddae01c68719546e8e423035bf189
SHA256

e3e46f0d836d7536b5f14324d34ffe38fc337a9c09fbf0429fdd9fe82d1e1ba4
SHA512

dc09eaa39349a2d4c90a904b85bdb8c7abebb83c6e1f00aeb0efcbca09e2444f97550fb0c8ea1600855b77278ccd4834f8cab11f151bf15b7f340a997a069bcc
SSDEEP

1536:l2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PI9:lZv5PDwbjNrmAE+tI9

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjIxOTYyOTc4MzE1ODgwNQ.GxLQZ8.DRpyOqRKH2MlfrQEsy0l2IIHWvJ9hbwMpr2sCc
server_id
1302215304264290354

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ZoraraUI.exe

description	pid	Process	procid_target
PID 276 wrote to memory of 2312	276	ZoraraUI.exe	31
PID 276 wrote to memory of 2312	276	ZoraraUI.exe	31
PID 276 wrote to memory of 2312	276	ZoraraUI.exe	31

C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe
"C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 276 -s 600
  2⤵
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-0-0x000007FEF63F3000-0x000007FEF63F4000-memory.dmp

Filesize
4KB

Download
memory/276-1-0x000000013F420000-0x000000013F43C000-memory.dmp

Filesize
112KB

Download
memory/276-2-0x000007FEF63F0000-0x000007FEF6DDC000-memory.dmp

Filesize
9.9MB

Download
memory/276-3-0x000007FEF63F0000-0x000007FEF6DDC000-memory.dmp

Filesize
9.9MB

Download