discordrat | a6a06c0dfde199f8edd355877fd3cd4881ee4d3a5dc0877a01ce1fd1524a87d4 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 17:55

Sharing

Report Analysis Logs

General

Target

Incogft Executor/Incogt/incogt.exe
Size

78KB
MD5

a0d25e1a573c4e51f52c830846c7ca1e
SHA1

496b4d3c05688ea34d36189cf80eddd1faa01600
SHA256

cfec1ef46283cb7a1684eb25497607b39bcc4b6f457c7e0526105cc74dcdf348
SHA512

0e092da7733b7b82ae59c4b372a51be3b0f94acffa455fef1c83f7624c8eb9ba143bc513a6f84dc12f911b15894b5cc3adbb2b286c2cdd3348c079525f1ea820
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+CPIC:5Zv5PDwbjNrmAE+uIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNDYxNDI2NjUzNTQ3NzI2OQ.GvE3OW.ygCVYZPAbul7wZgdx2a4I0nc_JUxKYOVJNdv1c
server_id
1314608412302250004

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2092	2340	incogt.exe	30
PID 2340 wrote to memory of 2092	2340	incogt.exe	30
PID 2340 wrote to memory of 2092	2340	incogt.exe	30

C:\Users\Admin\AppData\Local\Temp\Incogft Executor\Incogt\incogt.exe
"C:\Users\Admin\AppData\Local\Temp\Incogft Executor\Incogt\incogt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2340 -s 596
  2⤵
  PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x000000013FCC0000-0x000000013FCD8000-memory.dmp

Filesize
96KB

Download
memory/2340-2-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2340-3-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download