discordrat | 0e46fceb1c9f7c5a9af9070b501d2c2e5947124e68b3c83e0e524297b44e6679 | Triage

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 13:17

Sharing

Report Analysis Logs

General

Target

bestvpn.exe
Size

78KB
MD5

568a190c247f9d39952b107c93a66d1d
SHA1

77ce6ab4b3bb1389b7d94ca59763818b47c2bad0
SHA256

0e46fceb1c9f7c5a9af9070b501d2c2e5947124e68b3c83e0e524297b44e6679
SHA512

ccd3058ca4255c096bee491292ab6ac727f432d5010df70764b2f8e0a4bf7e551b24385a3bbc2334151d7ea007ae1460895f64a194c205f9ade5def35b40a92e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPIC:5Zv5PDwbjNrmAE+DIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMTYxODk3MDA2Mjk0NjM0NA.GcRLiH.0YYU-yTDH47oCFP4g5A5iATpFycgR4BpZljG6A
server_id
1311232819468566609

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bestvpn.exe

description	pid	Process	procid_target
PID 2272 wrote to memory of 2740	2272	bestvpn.exe	30
PID 2272 wrote to memory of 2740	2272	bestvpn.exe	30
PID 2272 wrote to memory of 2740	2272	bestvpn.exe	30

C:\Users\Admin\AppData\Local\Temp\bestvpn.exe
"C:\Users\Admin\AppData\Local\Temp\bestvpn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2272 -s 600
  2⤵
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x000000013F070000-0x000000013F088000-memory.dmp

Filesize
96KB

Download
memory/2272-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download