discordrat | 17d2a00f486e9f6aff348c7528fd49b59527661b8b012e08cfd629467930ba6e | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 19:11

Sharing

Report Analysis Logs

General

Target

Shiroku.exe
Size

78KB
MD5

670fca098e8eb2dc3a9dfe676accce48
SHA1

1cf1cca180ecee2f2f027d8ed9d4a375fe4ba5cf
SHA256

17d2a00f486e9f6aff348c7528fd49b59527661b8b012e08cfd629467930ba6e
SHA512

23ec447fec421d70ac910e5b4b639ed5fb081f7398a074443f4959516cae4ae981b1ac190187dde889f975fb2ac27795697f17ecbd78c130d04a84e083cdbbe0
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPIC:5Zv5PDwbjNrmAE+7IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMTM2OTUzNjQ1MjQzMTg4Mg.G-gxB9.YEQtR53nPmfGIrIfr7r6v6pYcS-y6sD07JFL74
server_id
1311367307922247813

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Shiroku.exe

description	pid	Process	procid_target
PID 2932 wrote to memory of 2164	2932	Shiroku.exe	31
PID 2932 wrote to memory of 2164	2932	Shiroku.exe	31
PID 2932 wrote to memory of 2164	2932	Shiroku.exe	31

C:\Users\Admin\AppData\Local\Temp\Shiroku.exe
"C:\Users\Admin\AppData\Local\Temp\Shiroku.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 596
  2⤵
  PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download
memory/2932-1-0x000000013F710000-0x000000013F728000-memory.dmp

Filesize
96KB

Download
memory/2932-2-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-3-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download