discordrat | 818c55e121b7b6862ae0ceda1abcdd70e0d7273cbfbb73b61b01c78795ba162f | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 19:43

Sharing

Report Analysis Logs

General

Target

Aqua-Slotted-Launcher.exe
Size

78KB
MD5

cee69ee17f0ff3a8f8c5a7041ca559d8
SHA1

fa7f5c9dad72ed8f1dda9fa3fe3d438e8e65e22f
SHA256

818c55e121b7b6862ae0ceda1abcdd70e0d7273cbfbb73b61b01c78795ba162f
SHA512

eeb92999297660fbce913ca43b4e81c8bf60d6fc0bc8ef8654fc4537ad89a868228a7b0c25a2551fdd8cc7cec53616ccfe827dc1d460e54ca83aadab66254c28
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwNDUyNjgyMjkzMDc3NjEzNQ.G2I0Jr._KsAczTibj-7_f6QRsGNGcCc2e-OFiVNGM0Na4
server_id
1304528345966444547

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2456	1740	Aqua-Slotted-Launcher.exe	31
PID 1740 wrote to memory of 2456	1740	Aqua-Slotted-Launcher.exe	31
PID 1740 wrote to memory of 2456	1740	Aqua-Slotted-Launcher.exe	31

C:\Users\Admin\AppData\Local\Temp\Aqua-Slotted-Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Aqua-Slotted-Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1740 -s 600
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x000000013F240000-0x000000013F258000-memory.dmp

Filesize
96KB

Download
memory/1740-2-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1740-3-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download