discordrat | 83b8cb9f6fc8b0d9c2ea00237153051b92faee2bc90d9dbf5ac62dcf10d361e8 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 18:16

Sharing

Report Analysis Logs

General

Target

verify.exe
Size

78KB
MD5

ddf8aa548cf5c42bd7399117eed298dd
SHA1

a9166aa27dfe2c81aa3b897fe6bf6dccde268fb4
SHA256

83b8cb9f6fc8b0d9c2ea00237153051b92faee2bc90d9dbf5ac62dcf10d361e8
SHA512

8d4d40225da287fe2e6647a694deb3fdbabee55536a86e3cd47eb651ce84d7bb030b699828944076b345acb12036a6a694f4c902c85670bcb12cf6c5efc4d741
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PIC:5Zv5PDwbjNrmAE+HIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMzUwNTc1ODQ3MzYyMTUxNA.GEstRj.TKeczpDrTK0oQpy8R4VP1ZtwXAi2iFDXFb9V0Y
server_id
1252699178128375888

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

verify.exe

description	pid	Process	procid_target
PID 1800 wrote to memory of 2220	1800	verify.exe	30
PID 1800 wrote to memory of 2220	1800	verify.exe	30
PID 1800 wrote to memory of 2220	1800	verify.exe	30

C:\Users\Admin\AppData\Local\Temp\verify.exe
"C:\Users\Admin\AppData\Local\Temp\verify.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1800 -s 596
  2⤵
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-0-0x000007FEF5E63000-0x000007FEF5E64000-memory.dmp

Filesize
4KB

Download
memory/1800-1-0x000000013F530000-0x000000013F548000-memory.dmp

Filesize
96KB

Download
memory/1800-2-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/1800-3-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download