discordrat | 520c9121e4236117c2784be4d856a7d819b5f614e6469a86edcceccacb9771d4 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 08:59

Sharing

Report Analysis Logs

General

Target

74690cdf2edc26f42d100325241e1117.exe
Size

78KB
MD5

74690cdf2edc26f42d100325241e1117
SHA1

6905ea513cf4a9fcf94f5efff1933fdaf5e980f5
SHA256

520c9121e4236117c2784be4d856a7d819b5f614e6469a86edcceccacb9771d4
SHA512

1af915c6d421e5a3bb003985e513eaeb9a101a2006a2e338ae172da145ad98b2139bbca7e42a18b926ed7b489f6dcb347e85e6695f2f60ac7f80b0816110f255
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwMjY2NDA1NTE5ODg0NzAzNw.GBgvm-.FTCvKdBZdhUCywGcaCtSocdcqrjxGR0rEILNeA
server_id
1202543313526464574

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 804	2528	74690cdf2edc26f42d100325241e1117.exe	30
PID 2528 wrote to memory of 804	2528	74690cdf2edc26f42d100325241e1117.exe	30
PID 2528 wrote to memory of 804	2528	74690cdf2edc26f42d100325241e1117.exe	30

C:\Users\Admin\AppData\Local\Temp\74690cdf2edc26f42d100325241e1117.exe
"C:\Users\Admin\AppData\Local\Temp\74690cdf2edc26f42d100325241e1117.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2528 -s 600
  2⤵
  PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-0-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x000000013F260000-0x000000013F278000-memory.dmp

Filesize
96KB

Download
memory/2528-2-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

Filesize
9.9MB

Download
memory/2528-3-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

Filesize
9.9MB

Download