discordrat | c04d8e594bbf9f43d9eb4258ca841223723acba5d589bbb930075e548c50a68b | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 21:39

Sharing

Report Analysis Logs

General

Target

Mooncheats.exe
Size

78KB
MD5

38e4b7ff4a920761992ca63ebcd26e00
SHA1

52802365d5d322f32650c442b9ab8dd9e83e781a
SHA256

c04d8e594bbf9f43d9eb4258ca841223723acba5d589bbb930075e548c50a68b
SHA512

7643e6b1d0e9bc35d98a8f678d384bec993e92daa822a725264b2977fcf8f7b01d4f290227e3479d075ec4f7ce908e3b4833501c71e9655306ad52617326ae10
SSDEEP

1536:P2WjO8XeEXFV5P7v88wbjNrfxCXhRoKV6+V+BPIC:PZ75PDwbjNrmAE+RIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMTU0ODcwMzk2NTg0MzUxNg.GPuVA3.CyklsGzX37HNAn2aXN3K0s0SNEGALNOLa1qq7A
server_id
1311541606738038905

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Mooncheats.exe

description	pid	Process	procid_target
PID 2980 wrote to memory of 1780	2980	Mooncheats.exe	30
PID 2980 wrote to memory of 1780	2980	Mooncheats.exe	30
PID 2980 wrote to memory of 1780	2980	Mooncheats.exe	30

C:\Users\Admin\AppData\Local\Temp\Mooncheats.exe
"C:\Users\Admin\AppData\Local\Temp\Mooncheats.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2980 -s 596
  2⤵
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2980-0-0x000007FEF4F63000-0x000007FEF4F64000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x000000013F8D0000-0x000000013F8E8000-memory.dmp

Filesize
96KB

Download
memory/2980-2-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2980-3-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download