discordrat | 4e4c57277d017ee55b96d8194e95fb0ea46792cd664d13e63057e29ad1a20aa6 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/12/2024, 17:06

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

1c5c1fa386a2383e92c9a0577c539df8
SHA1

dcd6ed90f64107403014b97675cdf66a69f61213
SHA256

4e4c57277d017ee55b96d8194e95fb0ea46792cd664d13e63057e29ad1a20aa6
SHA512

72cb27f98177f35165fa8db764dfdf29aee9b29658b7403c217c27d587ad9cc75536f73207f84c189602c5bf3bdae3fcdf4b7d4c472dd9ad82f581c1cf8bf74e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNTM2MTk4MzI4OTM2NDU4Mg.GGHnU-.huq7OOixCP2IXRz05UXlgcfl45nO8jCZjzESVQ
server_id
1315362406309953647

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2232	2432	Client-built.exe	31
PID 2432 wrote to memory of 2232	2432	Client-built.exe	31
PID 2432 wrote to memory of 2232	2432	Client-built.exe	31

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2432 -s 596
  2⤵
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x000007FEF5523000-0x000007FEF5524000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x000000013F640000-0x000000013F658000-memory.dmp

Filesize
96KB

Download
memory/2432-2-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

Filesize
9.9MB

Download
memory/2432-3-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

Filesize
9.9MB

Download