discordrat | 9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a

Resubmissions

03-11-2024 00:29

241103-atdf2syray 10

03-11-2024 00:27

03-11-2024 00:23

03-11-2024 00:19

03-11-2024 00:16

03-11-2024 00:11

Analysis

max time kernel
100s
max time network
143s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-11-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

do not download and run.exe
Size

78KB
MD5

f2c5e50d71723a255faafb127396b119
SHA1

5784b322726fe05abae13b8dde3c6bcb10eaf83f
SHA256

9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a
SHA512

5a955fca58d1f105d5ffe6004b18e013f69dbf0a06538d5c6192e9964e7249a7cbb8335411b263d56cb8108bf610f29f4c848c0d38f0c68bcfac73bb0a341259
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjMwNTMyNzY2MzkzOTcyNg.GkZ69I.EmDu656kW3-o_fxbEajqbFdrqzR7r2g-hNmbM0
server_id
1302304456985149450

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
43	discord.com
44	discord.com
45	discord.com
13	discord.com
15	discord.com
23	discord.com
25	discord.com
28	discord.com

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

SCHTASKS.exe

pid	Process
2352	SCHTASKS.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

do not download and run.exe

description	pid	Process
Token: SeDebugPrivilege	4244	do not download and run.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

do not download and run.exe

description	pid	Process	procid_target
PID 4244 wrote to memory of 2352	4244	do not download and run.exe	90
PID 4244 wrote to memory of 2352	4244	do not download and run.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\do not download and run.exe
"C:\Users\Admin\AppData\Local\Temp\do not download and run.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "$77do not download and run.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\do not download and run.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4244-0-0x00007FFD8F9F3000-0x00007FFD8F9F5000-memory.dmp

Filesize
8KB

Download
memory/4244-1-0x0000024350290000-0x00000243502A8000-memory.dmp

Filesize
96KB

Download
memory/4244-2-0x000002436A9A0000-0x000002436AB62000-memory.dmp

Filesize
1.8MB

Download
memory/4244-3-0x00007FFD8F9F0000-0x00007FFD904B2000-memory.dmp

Filesize
10.8MB

Download
memory/4244-4-0x000002436B1A0000-0x000002436B6C8000-memory.dmp

Filesize
5.2MB

Download
memory/4244-5-0x00007FFD8F9F3000-0x00007FFD8F9F5000-memory.dmp

Filesize
8KB

Download
memory/4244-6-0x00007FFD8F9F0000-0x00007FFD904B2000-memory.dmp

Filesize
10.8MB

Download