discordrat | 9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a

Resubmissions

03-11-2024 00:29

241103-atdf2syray 10

03-11-2024 00:27

03-11-2024 00:23

03-11-2024 00:19

03-11-2024 00:16

03-11-2024 00:11

Analysis

max time kernel
96s
max time network
128s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-11-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

do not download and run.exe
Size

78KB
MD5

f2c5e50d71723a255faafb127396b119
SHA1

5784b322726fe05abae13b8dde3c6bcb10eaf83f
SHA256

9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a
SHA512

5a955fca58d1f105d5ffe6004b18e013f69dbf0a06538d5c6192e9964e7249a7cbb8335411b263d56cb8108bf610f29f4c848c0d38f0c68bcfac73bb0a341259
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjMwNTMyNzY2MzkzOTcyNg.GkZ69I.EmDu656kW3-o_fxbEajqbFdrqzR7r2g-hNmbM0
server_id
1302304456985149450

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

Processes:

flow	ioc
31	discord.com
32	discord.com
16	discord.com
17	discord.com
22	discord.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

do not download and run.exe

description	pid	Process
Token: SeDebugPrivilege	3272	do not download and run.exe

C:\Users\Admin\AppData\Local\Temp\do not download and run.exe
"C:\Users\Admin\AppData\Local\Temp\do not download and run.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3272-0-0x00007FFB63343000-0x00007FFB63345000-memory.dmp

Filesize
8KB

Download
memory/3272-1-0x000001FC5D040000-0x000001FC5D058000-memory.dmp

Filesize
96KB

Download
memory/3272-2-0x000001FC77600000-0x000001FC777C2000-memory.dmp

Filesize
1.8MB

Download
memory/3272-3-0x00007FFB63340000-0x00007FFB63E02000-memory.dmp

Filesize
10.8MB

Download
memory/3272-4-0x000001FC77E40000-0x000001FC78368000-memory.dmp

Filesize
5.2MB

Download
memory/3272-5-0x00007FFB63343000-0x00007FFB63345000-memory.dmp

Filesize
8KB

Download
memory/3272-6-0x00007FFB63340000-0x00007FFB63E02000-memory.dmp

Filesize
10.8MB

Download