discordrat | 9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 00:30

Sharing

Report Analysis Logs

General

Target

donotdownloadandrun.exe
Size

78KB
MD5

f2c5e50d71723a255faafb127396b119
SHA1

5784b322726fe05abae13b8dde3c6bcb10eaf83f
SHA256

9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a
SHA512

5a955fca58d1f105d5ffe6004b18e013f69dbf0a06538d5c6192e9964e7249a7cbb8335411b263d56cb8108bf610f29f4c848c0d38f0c68bcfac73bb0a341259
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjMwNTMyNzY2MzkzOTcyNg.GkZ69I.EmDu656kW3-o_fxbEajqbFdrqzR7r2g-hNmbM0
server_id
1302304456985149450

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

donotdownloadandrun.exe

description	pid	Process	procid_target
PID 2508 wrote to memory of 2404	2508	donotdownloadandrun.exe	30
PID 2508 wrote to memory of 2404	2508	donotdownloadandrun.exe	30
PID 2508 wrote to memory of 2404	2508	donotdownloadandrun.exe	30

C:\Users\Admin\AppData\Local\Temp\donotdownloadandrun.exe
"C:\Users\Admin\AppData\Local\Temp\donotdownloadandrun.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2508 -s 596
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-0-0x000007FEF4FC3000-0x000007FEF4FC4000-memory.dmp

Filesize
4KB

Download
memory/2508-1-0x000000013FA50000-0x000000013FA68000-memory.dmp

Filesize
96KB

Download
memory/2508-2-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2508-3-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download