discordrat | 0caf4f2c21a947aa1bb488a0c2cf1855c50e7ff3cab2f1030619614d0ef9187b | Triage

Analysis

max time kernel
91s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 17:18

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

de1ec0402dce880bdda03f2e1b07c234
SHA1

925878d15fa620429894c8e0df57a15d1c6e3bf3
SHA256

0caf4f2c21a947aa1bb488a0c2cf1855c50e7ff3cab2f1030619614d0ef9187b
SHA512

298496412d430324502db0cf8512005db7637c66655258a93b4f94373d621f19e7ca503991666354c56b73ee2d56159c4ee9e6df00b6144500a174a225de4db0
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+fPIC:5Zv5PDwbjNrmAE+nIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNTM2MTk4MzI4OTM2NDU4Mg.GGHnU-.huq7OOixCP2IXRz05UXlgcfl45nO8jCZjzESVQ
server_id
1315365232385986602

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2768	1900	Client-built.exe	30
PID 1900 wrote to memory of 2768	1900	Client-built.exe	30
PID 1900 wrote to memory of 2768	1900	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1900 -s 600
  2⤵
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x000007FEF4EB3000-0x000007FEF4EB4000-memory.dmp

Filesize
4KB

Download
memory/1900-1-0x000000013F330000-0x000000013F348000-memory.dmp

Filesize
96KB

Download
memory/1900-2-0x000007FEF4EB0000-0x000007FEF589C000-memory.dmp

Filesize
9.9MB

Download
memory/1900-3-0x000007FEF4EB0000-0x000007FEF589C000-memory.dmp

Filesize
9.9MB

Download