discordrat | e3710ea90501675d0e0115d277cdb1ee5a3ed377d0de81128ccdad5d6c96182f | Triage

Resubmissions

04-11-2024 19:53

241104-ymfvlawgnn 10

04-11-2024 18:47

241104-xfb3dswakn 10

Analysis

max time kernel
8s
max time network
0s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 18:47

Sharing

Report Analysis Logs

General

Target

NixwareCrack.exe
Size

78KB
MD5

376bd2d97cc2ba77cd6da672ba177ed2
SHA1

302ac8e952a6e1c6139cbb68bc7e1d1b3a9b3c7c
SHA256

e3710ea90501675d0e0115d277cdb1ee5a3ed377d0de81128ccdad5d6c96182f
SHA512

d10de99746f1be26c9ee9bc37280f1240e844f185c1f4c5076bcb688bd82af5f61841263d8e5d54f2392a12df42f830458c8106dcd82e4bae204f7a1c1ed5aaf
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjM1NTczNTkyNTEwMDY3NA.GwroMp.ikOfR8hGBRGsTwLXKnVA4_qSIDO9_Syvc6QRrs
server_id
1302358412364873738

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2000	2292	NixwareCrack.exe	28
PID 2292 wrote to memory of 2000	2292	NixwareCrack.exe	28
PID 2292 wrote to memory of 2000	2292	NixwareCrack.exe	28

C:\Users\Admin\AppData\Local\Temp\NixwareCrack.exe
"C:\Users\Admin\AppData\Local\Temp\NixwareCrack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2292 -s 596
  2⤵
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x000000013F4F0000-0x000000013F508000-memory.dmp

Filesize
96KB

Download
memory/2292-2-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/2292-3-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download