discordrat | 9ceae2c5cb19ece43359a6c0d297257fef4edd387e97404a9745e09ef857a4a1 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/11/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BuiltLoader.exe
Size

78KB
MD5

acaf2d375d1a07245467d81e7eafeef3
SHA1

385fbf49b318ff3852826ae7c41a7ff6cfc84a45
SHA256

9ceae2c5cb19ece43359a6c0d297257fef4edd387e97404a9745e09ef857a4a1
SHA512

63fcc327fc7039c67fb14a2ba40843b72f523dcce622d295a9a144e0b0d90a2bdcd16207d3615c765682a7fbf359a3e5e739011effe574e36ddadc35f771bdbb
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMDA4MTEwMTM4NDkwODg5MA.GOW1wk.RobN1TvC6kDgxifCNfNfDg356aIiV3SksRDBKA
server_id
1309037779530940456

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2288	2824	BuiltLoader.exe	30
PID 2824 wrote to memory of 2288	2824	BuiltLoader.exe	30
PID 2824 wrote to memory of 2288	2824	BuiltLoader.exe	30

C:\Users\Admin\AppData\Local\Temp\BuiltLoader.exe
"C:\Users\Admin\AppData\Local\Temp\BuiltLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2824 -s 596
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-0-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

Filesize
4KB

Download
memory/2824-1-0x000000013F510000-0x000000013F528000-memory.dmp

Filesize
96KB

Download
memory/2824-2-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmp

Filesize
9.9MB

Download
memory/2824-3-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmp

Filesize
9.9MB

Download