discordrat | 6efdd6a49217dcdcc8fc1b26dd2c0c023105736a554716c206015393968aa424 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 08:08

Sharing

Report Analysis Logs

General

Target

Vixen-public.exe
Size

78KB
MD5

42f16e60e38e9dd1091f72555d892686
SHA1

049e0dd571b54cce4fe634d2f9b850d277cf7c1a
SHA256

6efdd6a49217dcdcc8fc1b26dd2c0c023105736a554716c206015393968aa424
SHA512

5d590ff46e3832dab97ca83137a17d404053340906ef1ee296960776cb2194dc27d46443f209af1a50a726d0fc0f74950558bd955d0e6a41e00c5b17036a5f44
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YyPIC:5Zv5PDwbjNrmAE+xIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwOTIxOTM2NDE3MTQxOTc4MQ.G6A56u.qsHM8m4V7QardZkCCxRu6StelSyhMJnGYFYO4Q
server_id
1309220128130465842

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1800	1624	Vixen-public.exe	31
PID 1624 wrote to memory of 1800	1624	Vixen-public.exe	31
PID 1624 wrote to memory of 1800	1624	Vixen-public.exe	31

C:\Users\Admin\AppData\Local\Temp\Vixen-public.exe
"C:\Users\Admin\AppData\Local\Temp\Vixen-public.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1624 -s 596
  2⤵
  PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/1624-1-0x000000013F5A0000-0x000000013F5B8000-memory.dmp

Filesize
96KB

Download
memory/1624-2-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/1624-3-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download