discordrat | 9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a | Triage

Resubmissions

03-11-2024 00:29

241103-atdf2syray 10

03-11-2024 00:27

241103-art11syqfv 10

03-11-2024 00:23

241103-aptmgayqbt 10

03-11-2024 00:19

241103-amd41asmhq 10

03-11-2024 00:16

241103-akx44asmfm 10

03-11-2024 00:11

241103-ag1qtaynft 10

Analysis

max time kernel
76s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 00:29

Sharing

Report Analysis Logs

General

Target

do not download and run.exe
Size

78KB
MD5

f2c5e50d71723a255faafb127396b119
SHA1

5784b322726fe05abae13b8dde3c6bcb10eaf83f
SHA256

9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a
SHA512

5a955fca58d1f105d5ffe6004b18e013f69dbf0a06538d5c6192e9964e7249a7cbb8335411b263d56cb8108bf610f29f4c848c0d38f0c68bcfac73bb0a341259
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjMwNTMyNzY2MzkzOTcyNg.GkZ69I.EmDu656kW3-o_fxbEajqbFdrqzR7r2g-hNmbM0
server_id
1302304456985149450

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

do not download and run.exe

description	pid	Process	procid_target
PID 2848 wrote to memory of 540	2848	do not download and run.exe	31
PID 2848 wrote to memory of 540	2848	do not download and run.exe	31
PID 2848 wrote to memory of 540	2848	do not download and run.exe	31

C:\Users\Admin\AppData\Local\Temp\do not download and run.exe
"C:\Users\Admin\AppData\Local\Temp\do not download and run.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2848 -s 600
  2⤵
  PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2848-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2848-1-0x000000013FB50000-0x000000013FB68000-memory.dmp

Filesize
96KB

Download
memory/2848-2-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/2848-3-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download