discordrat | d2ca967b6093ef03d38960444b4a9d9e30f332bc7ed86920096ea2310f32392e | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 16:23

Sharing

Report Analysis Logs

General

Target

NitroGenV3.exe
Size

78KB
MD5

508bbb8bf4efac317cfd1d9532bdebfe
SHA1

a145b6ab1d5543097ca09c7b936d532f718bc087
SHA256

1fd008d0c903210ebb97f0c7d15a2b03bbe28e5fc3ac296e5482f6926e3ee17e
SHA512

7e3dd45677be1df9c8c8a6e65e75454a9798eddaf8a6eb2db8207fe4f6e99378a7e87e5d8ee23dae403854aa19c0122ed97668567909cd60db6f6d1f376036f4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+hPIC:5Zv5PDwbjNrmAE+xIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5Njg1MDA0NzU2NDkxNDcxOA.GrJUg1.lgWsOKN3lnatoZgt8R8bNns8frpVGolFi2OtF8
server_id
1196851278773485601

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

NitroGenV3.exe

description	pid	Process	procid_target
PID 2700 wrote to memory of 2844	2700	NitroGenV3.exe	31
PID 2700 wrote to memory of 2844	2700	NitroGenV3.exe	31
PID 2700 wrote to memory of 2844	2700	NitroGenV3.exe	31

C:\Users\Admin\AppData\Local\Temp\NitroGenV3.exe
"C:\Users\Admin\AppData\Local\Temp\NitroGenV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2700 -s 596
  2⤵
  PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download
memory/2700-1-0x000000013F110000-0x000000013F128000-memory.dmp

Filesize
96KB

Download
memory/2700-2-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/2700-3-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download