discordrat | ef0f45565ff04a6a32ac2c45b05f58e76c3aee4147f90f64493cbe7774f264d3 | Triage

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 16:22

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

db5738e4067c9224b5f70a9fc592f80f
SHA1

24516fc2baa46a305211ab9a38385c10dcf6f4b6
SHA256

ef0f45565ff04a6a32ac2c45b05f58e76c3aee4147f90f64493cbe7774f264d3
SHA512

30635ecb5007d6ed9a90ca263c34c4808168c5a25aea7720e97d9f2764be48c07221f6c984421ad1b687e06dfcd07b0e1380dbb8841efcacbf5c6648cf63ff51
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjMwNTMyNzY2MzkzOTcyNg.G8RAAK.8sxeY5icxYIDAcJde2R5zytU1RgGsFaMt770pw
server_id
1302304456985149450

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	Process	procid_target
PID 2676 wrote to memory of 2780	2676	Client-built.exe	30
PID 2676 wrote to memory of 2780	2676	Client-built.exe	30
PID 2676 wrote to memory of 2780	2676	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2676 -s 600
  2⤵
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-0-0x000007FEF6123000-0x000007FEF6124000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x000000013F990000-0x000000013F9A8000-memory.dmp

Filesize
96KB

Download
memory/2676-2-0x000007FEF6120000-0x000007FEF6B0C000-memory.dmp

Filesize
9.9MB

Download
memory/2676-3-0x000007FEF6120000-0x000007FEF6B0C000-memory.dmp

Filesize
9.9MB

Download