discordrat | a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941c

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe
Size

1.5MB
MD5

d0130d6ff7a7b6304c3c1365c81306e0
SHA1

7438a088413ccbd36d63b97b09776a665bb34cd2
SHA256

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941c
SHA512

5b4b4063a8cd6c81d3cb68057037bb87650fa1486119558a748858268175a963dda14bb7a13bc8e35bf36f7cdf3fb64df5431fc428427a6da15cbf089a3087f2
SSDEEP

49152:4Djlabwz9JzFHkHPl6HG9TJQRehVbY/GBH:oqwvpkvQ2TJXVbY/Gl

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5OTkwMDExNjkxMTc4Mzk5Ng.GXP8iL.UA64rSAulOlRZb1XcgfzfPpH996h4Bcwuv6xpQ
server_id
1299900985652809840

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 1 IoCs

Processes:

Client-built.exe

pid	Process
2708	Client-built.exe

Loads dropped DLL 6 IoCs

Processes:

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exeWerFault.exe

pid	Process
276	a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe
1800	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exeClient-built.exe

description	pid	Process	procid_target
PID 276 wrote to memory of 2708	276	a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe	32
PID 276 wrote to memory of 2708	276	a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe	32
PID 276 wrote to memory of 2708	276	a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe	32
PID 2708 wrote to memory of 1800	2708	Client-built.exe	33
PID 2708 wrote to memory of 1800	2708	Client-built.exe	33
PID 2708 wrote to memory of 1800	2708	Client-built.exe	33

C:\Users\Admin\AppData\Local\Temp\a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe
"C:\Users\Admin\AppData\Local\Temp\a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:276
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2708 -s 600
    3⤵
    - Loads dropped DLL
    PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
78KB

MD5
bcc97c97fc8c30952e5917ecff83256b

SHA1
f33c1b004e827a89003a6add87df636e2e1f520a

SHA256
65bb9529aa27b4b78ac0cf242e790adf6b2b9ab013c84f24302dd17c9c1790a2

SHA512
738ca10cdd6d6fcd7f19504d0e579372ca4d22226ae3845c21cc88d9725a839c376d0ce0d974d53ba69d0b2363833b7bc0f226af99aa632692a5065c2b8b7eec

Download Submit
memory/276-4-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/2708-11-0x000007FEF5243000-0x000007FEF5244000-memory.dmp

Filesize
4KB

Download
memory/2708-12-0x000000013FC50000-0x000000013FC68000-memory.dmp

Filesize
96KB

Download
memory/2708-17-0x000007FEF5240000-0x000007FEF5C2C000-memory.dmp

Filesize
9.9MB

Download
memory/2708-19-0x000007FEF5240000-0x000007FEF5C2C000-memory.dmp

Filesize
9.9MB

Download