discordrat | d885c9538af8a75fcfa1068d536da0c17ecdfae94d5ec78c5dc13e5d5d9b45d8 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:17

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

362a8fc783d169847c31c9f2b01c030d
SHA1

ebb968222886098d57141feb6b62c6a786c41cb6
SHA256

d885c9538af8a75fcfa1068d536da0c17ecdfae94d5ec78c5dc13e5d5d9b45d8
SHA512

d0fdc4161584513cd94ff8b8747e25cc25cf2d366d55dcf62b35dabd9be5580221251237ee5a3e321188ad02835f2d2c9eccd03a95fd61f3674e33b03a849c28
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwOTIwNTEzMzEzNzE1MDA0Ng.GA5WMV.fewRiTxiSPepVlIhJwiQhRSfj0wzT0J7nzt1PY
server_id
1309205278260203640

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2756	1884	Client-built.exe	30
PID 1884 wrote to memory of 2756	1884	Client-built.exe	30
PID 1884 wrote to memory of 2756	1884	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1884 -s 600
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-0-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmp

Filesize
4KB

Download
memory/1884-1-0x000000013FE50000-0x000000013FE68000-memory.dmp

Filesize
96KB

Download
memory/1884-2-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download
memory/1884-3-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download