discordrat | df0f1ba7f14d8010ab736bc87df0088f16bd681032b99028ca2fd55a37ba9990 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 22:58

Sharing

Report Analysis Logs

General

Target

Synapse Remake.exe
Size

78KB
MD5

25330af650f743dbfb0694b8af39b2ee
SHA1

cdbcdce595b5c9f0b7aa252c91c4cea4e3f87625
SHA256

df0f1ba7f14d8010ab736bc87df0088f16bd681032b99028ca2fd55a37ba9990
SHA512

2f8411ffee4dadaa857a9a543d0399d4bf23aeb8910fcf268e4f500e04a82217740981e4f0ad8c0a38d66d212019179d97b4d75ddfdfe89331e4e14a4fd44d22
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMzEyODg4MDQ1Nzk3Nzg5Nw.Gi6BXD.RVPmVWaLt522iQobgVZsWmNevehLyZo0E_qW-w
server_id
1302680326551765002

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Synapse Remake.exe

description	pid	process	target process
PID 2828 wrote to memory of 2156	2828	Synapse Remake.exe	WerFault.exe
PID 2828 wrote to memory of 2156	2828	Synapse Remake.exe	WerFault.exe
PID 2828 wrote to memory of 2156	2828	Synapse Remake.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Synapse Remake.exe
"C:\Users\Admin\AppData\Local\Temp\Synapse Remake.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2828 -s 604
  2⤵
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x000007FEF53F3000-0x000007FEF53F4000-memory.dmp

Filesize
4KB

Download
memory/2828-1-0x000000013F1D0000-0x000000013F1E8000-memory.dmp

Filesize
96KB

Download
memory/2828-2-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2828-3-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download