discordrat | 06e548f88374459b49acf9269c108040582f602cde52e5f1e1e02ef1b89b4fea

General

Target

release.rar
Size

783KB
MD5

1f4bdbaaf4a9997b0519dfec1116375c
SHA1

5b0d7aca31b38fea1628012eed2d272f452246ee
SHA256

06e548f88374459b49acf9269c108040582f602cde52e5f1e1e02ef1b89b4fea
SHA512

3497bbfbdfa024e8e8672c85ee1217e1adbce506df04a27058bf1b9e3bcd17fc80a73dd4e4fbfabd06ce97572af3b30fb2ac45e706a87a95ab8b08e0fd1997b3
SSDEEP

24576:5opkq75paphGwjhaAFnWt66OncboOILA76Ga1eESXxly3g:ap5WljIAFnWqncboOWGaMgQ

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5ODI2NDAyNjg1NzM0NTA1Nw.GUZLej.EaO4IOf1dr7yOFnfuhJGaGXi2EiM1tKWokUH1Q
server_id
1298249568756174859

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Executes dropped EXE 2 IoCs

Processes:

builder.exebuilder.exe

pid process

1224 builder.exe
2808 builder.exe

pid	process
1224	builder.exe
2808	builder.exe

Loads dropped DLL 12 IoCs

Processes:

7zFM.exeWerFault.exeWerFault.exe

pid	process
2100	7zFM.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
2100	7zFM.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.text\ = "text_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\shell\edit\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.text	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\text_auto_file\shell\open	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

7zFM.exe

pid process

2100 7zFM.exe
2100 7zFM.exe
2100 7zFM.exe
2100 7zFM.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2100 7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7zFM.exe

description	pid	process
Token: SeRestorePrivilege	2100	7zFM.exe
Token: 35	2100	7zFM.exe
Token: SeSecurityPrivilege	2100	7zFM.exe
Token: SeSecurityPrivilege	2100	7zFM.exe
Token: SeSecurityPrivilege	2100	7zFM.exe
Token: SeSecurityPrivilege	2100	7zFM.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

7zFM.exe

pid process

2100 7zFM.exe
2100 7zFM.exe
2100 7zFM.exe
2100 7zFM.exe
2100 7zFM.exe
2100 7zFM.exe
2100 7zFM.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

7zFM.exebuilder.exebuilder.exerundll32.exe

description	pid	process	target process
PID 2100 wrote to memory of 1224	2100	7zFM.exe	builder.exe
PID 2100 wrote to memory of 1224	2100	7zFM.exe	builder.exe
PID 2100 wrote to memory of 1224	2100	7zFM.exe	builder.exe
PID 1224 wrote to memory of 1948	1224	builder.exe	WerFault.exe
PID 1224 wrote to memory of 1948	1224	builder.exe	WerFault.exe
PID 1224 wrote to memory of 1948	1224	builder.exe	WerFault.exe
PID 2100 wrote to memory of 2808	2100	7zFM.exe	builder.exe
PID 2100 wrote to memory of 2808	2100	7zFM.exe	builder.exe
PID 2100 wrote to memory of 2808	2100	7zFM.exe	builder.exe
PID 2808 wrote to memory of 2608	2808	builder.exe	WerFault.exe
PID 2808 wrote to memory of 2608	2808	builder.exe	WerFault.exe
PID 2808 wrote to memory of 2608	2808	builder.exe	WerFault.exe
PID 2100 wrote to memory of 2168	2100	7zFM.exe	rundll32.exe
PID 2100 wrote to memory of 2168	2100	7zFM.exe	rundll32.exe
PID 2100 wrote to memory of 2168	2100	7zFM.exe	rundll32.exe
PID 2168 wrote to memory of 2716	2168	rundll32.exe	NOTEPAD.EXE
PID 2168 wrote to memory of 2716	2168	rundll32.exe	NOTEPAD.EXE
PID 2168 wrote to memory of 2716	2168	rundll32.exe	NOTEPAD.EXE

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\release.rar"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\7zO438360C6\builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO438360C6\builder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1224 -s 596
    3⤵
    - Loads dropped DLL
    PID:1948
- C:\Users\Admin\AppData\Local\Temp\7zO438CC117\builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO438CC117\builder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2808 -s 596
    3⤵
    - Loads dropped DLL
    PID:2608
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7zO4384B347\.text
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO4384B347\.text
    3⤵
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO438360C6\builder.exe

Filesize
78KB

MD5
c4a7023d35c75b966fbde8d59fed7e17

SHA1
ce7e86b760a2f4163a8330592b7518e5979ce8ee

SHA256
6695c3ee0505eec9a12f4ab8e327e50ae48d9f7217c2588310f3cd6745db8403

SHA512
946e7fba6d932d7f2b88db6ab9b440c96654a9a0faa239eee118036be9e9c41417f7a286b37ef2545902571e049df12a62f0c231a38d60cc56a5e2e7414ce136

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4384B347\.text

Filesize
76KB

MD5
84e32ffed0fb4de27540e1a7200862c8

SHA1
9860748a7041a450a7237e9964e4f3bf36a8b6b2

SHA256
d4ed66bff2a5e6b2a42c87ea71d5e96ea97fd0e4b42dd93275d9305b0fc939b3

SHA512
f1c799c971f2eae21bf69dd7b539874b82140369db8c042e56b55623fbdaec7b968c370a1af9ea14a213be741d2c0000e9bc44f174e6186eefd2634093700851

Download Submit
memory/1224-8-0x000000013FEA0000-0x000000013FEB8000-memory.dmp

Filesize
96KB

Download
memory/2808-22-0x000000013F890000-0x000000013F8A8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads