discordrat | d885c9538af8a75fcfa1068d536da0c17ecdfae94d5ec78c5dc13e5d5d9b45d8

Resubmissions

26-11-2024 14:51

241126-r8c79ssjgp 10

21-11-2024 17:25

241121-vzbjvstcnd

Analysis

max time kernel
69s
max time network
72s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-11-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

362a8fc783d169847c31c9f2b01c030d
SHA1

ebb968222886098d57141feb6b62c6a786c41cb6
SHA256

d885c9538af8a75fcfa1068d536da0c17ecdfae94d5ec78c5dc13e5d5d9b45d8
SHA512

d0fdc4161584513cd94ff8b8747e25cc25cf2d366d55dcf62b35dabd9be5580221251237ee5a3e321188ad02835f2d2c9eccd03a95fd61f3674e33b03a849c28
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwOTIwNTEzMzEzNzE1MDA0Ng.GA5WMV.fewRiTxiSPepVlIhJwiQhRSfj0wzT0J7nzt1PY
server_id
1309205278260203640

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "200"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	Client-built.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3144	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4988

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a01855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-1-0x000002A16CDE0000-0x000002A16CDF8000-memory.dmp

Filesize
96KB

Download
memory/2340-0-0x00007FF839FF3000-0x00007FF839FF5000-memory.dmp

Filesize
8KB

Download
memory/2340-2-0x000002A16F4F0000-0x000002A16F6B2000-memory.dmp

Filesize
1.8MB

Download
memory/2340-3-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

Filesize
10.8MB

Download
memory/2340-4-0x000002A170770000-0x000002A170C98000-memory.dmp

Filesize
5.2MB

Download
memory/2340-5-0x00007FF839FF3000-0x00007FF839FF5000-memory.dmp

Filesize
8KB

Download
memory/2340-6-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

Filesize
10.8MB

Download
memory/2340-7-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

Filesize
10.8MB

Download