discordrat | a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941c

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe
Size

1.5MB
MD5

d0130d6ff7a7b6304c3c1365c81306e0
SHA1

7438a088413ccbd36d63b97b09776a665bb34cd2
SHA256

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941c
SHA512

5b4b4063a8cd6c81d3cb68057037bb87650fa1486119558a748858268175a963dda14bb7a13bc8e35bf36f7cdf3fb64df5431fc428427a6da15cbf089a3087f2
SSDEEP

49152:4Djlabwz9JzFHkHPl6HG9TJQRehVbY/GBH:oqwvpkvQ2TJXVbY/Gl

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5OTkwMDExNjkxMTc4Mzk5Ng.GXP8iL.UA64rSAulOlRZb1XcgfzfPpH996h4Bcwuv6xpQ
server_id
1299900985652809840

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe

Executes dropped EXE 1 IoCs

Processes:

Client-built.exe

pid process

4348 Client-built.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

15 discord.com
16 discord.com
20 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client-built.exe

description pid process

Token: SeDebugPrivilege 4348 Client-built.exe

pid	process
4348	Client-built.exe

flow	ioc
15	discord.com
16	discord.com
20	discord.com

description	pid	process
Token: SeDebugPrivilege	4348	Client-built.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe

description	pid	process	target process
PID 2040 wrote to memory of 4348	2040	a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe	Client-built.exe
PID 2040 wrote to memory of 4348	2040	a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe	Client-built.exe

C:\Users\Admin\AppData\Local\Temp\a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe
"C:\Users\Admin\AppData\Local\Temp\a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
78KB

MD5
bcc97c97fc8c30952e5917ecff83256b

SHA1
f33c1b004e827a89003a6add87df636e2e1f520a

SHA256
65bb9529aa27b4b78ac0cf242e790adf6b2b9ab013c84f24302dd17c9c1790a2

SHA512
738ca10cdd6d6fcd7f19504d0e579372ca4d22226ae3845c21cc88d9725a839c376d0ce0d974d53ba69d0b2363833b7bc0f226af99aa632692a5065c2b8b7eec

Download Submit
memory/4348-14-0x00007FF878723000-0x00007FF878725000-memory.dmp

Filesize
8KB

Download
memory/4348-15-0x0000025376300000-0x0000025376318000-memory.dmp

Filesize
96KB

Download
memory/4348-16-0x0000025378970000-0x0000025378B32000-memory.dmp

Filesize
1.8MB

Download
memory/4348-17-0x00007FF878720000-0x00007FF8791E1000-memory.dmp

Filesize
10.8MB

Download
memory/4348-18-0x0000025379A20000-0x0000025379F48000-memory.dmp

Filesize
5.2MB

Download
memory/4348-19-0x00007FF878723000-0x00007FF878725000-memory.dmp

Filesize
8KB

Download
memory/4348-20-0x00007FF878720000-0x00007FF8791E1000-memory.dmp

Filesize
10.8MB

Download