discordrat | 71c6f0f97739bd48d8bd14cef151389a33b4cb1842987b824b47fe521929cb65 | Triage

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 02:19

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

0040ce2b405b7c977b25770e3892ac11
SHA1

24f618b6ae0c3b6b8f4aa5d7801c2550c56c6f07
SHA256

1371d709aeca976839bb5ef2431e59548e4c0f700f3907a8803ecef207dcce6f
SHA512

f5cb842b0ba67b49f3a9b437293ac784ffcf1e1ad821defe0bfaf6778844debcba56c2cf44a733cc1e5090c753833038e31c17bbcdee85f3e499792bbb211f7a
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+mPIC:5Zv5PDwbjNrmAE+CIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5NjY1NzM0NDY3NTA1MzY2MQ.G3_pRe.obiFDZfiXBi7cjudA_ADjPYDq2ORDjJqG7qP6c
server_id
1303174293991063612

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2132 wrote to memory of 2144	2132	Client-built.exe	WerFault.exe
PID 2132 wrote to memory of 2144	2132	Client-built.exe	WerFault.exe
PID 2132 wrote to memory of 2144	2132	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2132 -s 596
  2⤵
  PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-0-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/2132-1-0x000000013F900000-0x000000013F918000-memory.dmp

Filesize
96KB

Download
memory/2132-2-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2132-3-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download