discordrat | 66de5621d581e9a00c389c264e20ca0e7b46ec943dc7a3763fffe12a5a10ddaf | Triage

Resubmissions

26-11-2024 14:00

241126-ra4ybszqfm 10

22-11-2024 01:30

241122-bwx4xa1paw 10

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 01:30

Sharing

Report Analysis Logs

General

Target

VanishRaider.exe
Size

78KB
MD5

9e4076a3fbfa1f3ecb81058ef4001fdd
SHA1

541296e7975cbdd435b4541ed3874de72dadac94
SHA256

66de5621d581e9a00c389c264e20ca0e7b46ec943dc7a3763fffe12a5a10ddaf
SHA512

069ba11a3709de05f3e196e709c99e5f3955fb431bf23c1128ee07b285e5b3906e618ae1e1e9704f6466d2c5e1bca9c1ae225aa2eda5ab10d51c34a8a1b47066
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4ODkwNzg5ODAzODI1NTcwOA.GgUucJ.D2rA49_EiGu77vh25hJjBiyYWeQreSfEVcBYTU
server_id
1287079655723106437

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

VanishRaider.exe

description	pid	process	target process
PID 2860 wrote to memory of 2792	2860	VanishRaider.exe	WerFault.exe
PID 2860 wrote to memory of 2792	2860	VanishRaider.exe	WerFault.exe
PID 2860 wrote to memory of 2792	2860	VanishRaider.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\VanishRaider.exe
"C:\Users\Admin\AppData\Local\Temp\VanishRaider.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2860 -s 596
  2⤵
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x000007FEF5A53000-0x000007FEF5A54000-memory.dmp

Filesize
4KB

Download
memory/2860-1-0x000000013FB60000-0x000000013FB78000-memory.dmp

Filesize
96KB

Download
memory/2860-2-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

Filesize
9.9MB

Download
memory/2860-3-0x000007FEF5A50000-0x000007FEF643C000-memory.dmp

Filesize
9.9MB

Download