discordrat | 99c5327241b7e8c75adc4f19e8854bbcd54128852a2e4fbd5f08102e5345fba8 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05/12/2024, 20:45

Sharing

Report Analysis Logs

General

Target

Ussr.exe
Size

78KB
MD5

dc3333f3b1df66a9d8b7484af5a99a6c
SHA1

5bcbdfadbb1e44acbc8629fe6f4de6b8f2655eb8
SHA256

99c5327241b7e8c75adc4f19e8854bbcd54128852a2e4fbd5f08102e5345fba8
SHA512

2b377425f83e62b1ccb8782cde125561710ea468cda9b8c4e34c7ce99cb52f72c40982cac6e60fdda52e28d6c586ce08f054276a10561ecea9e7241f48bcb1a6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+7PIC:5Zv5PDwbjNrmAE+zIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNDMyOTA2NjQ5MjM5OTY2Nw.G-SRs-.Xh5uhvNsgzv6hux0q1I4ScJ4ktOkXbUdZfIV5E
server_id
1314326888604237875

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1600	388	Ussr.exe	31
PID 388 wrote to memory of 1600	388	Ussr.exe	31
PID 388 wrote to memory of 1600	388	Ussr.exe	31

C:\Users\Admin\AppData\Local\Temp\Ussr.exe
"C:\Users\Admin\AppData\Local\Temp\Ussr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 388 -s 600
  2⤵
  PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-0-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

Filesize
4KB

Download
memory/388-1-0x000000013F750000-0x000000013F768000-memory.dmp

Filesize
96KB

Download
memory/388-2-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download
memory/388-3-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download