discordrat | 6e26cd89db50b9edaa16d472dd81b869a014ef5b48f9beddf2b7cd682649f402

Analysis

max time kernel
19s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.23.exe
Size

693KB
MD5

4fb8fe2bbbfa6fe0a143e1324dc4a5e8
SHA1

c70606a2ab08e430423314e6b3e8700e61c2cc27
SHA256

6e26cd89db50b9edaa16d472dd81b869a014ef5b48f9beddf2b7cd682649f402
SHA512

b70122c16c1a0d0e1e0ccdc2bae4c742c2038dc0b6e1f610543f303b0e24f8fafa7f7b09ce232888bb38be7d8498abef69f623f980e9c40e509e5cd48fe2a5a1
SSDEEP

12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t47pczJr+eNWsdHAYBPA6/S4XnL+0N:xuDXTIGaPhEYzUzA0/07pSr+eNg0FP9N

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMzEyNzU0NTc5MjYyNjcwOA.Gkk18Z.4N0_jmiIDKcoLtOmWe4t37gYWyEtG0NPmEV7c4
server_id
1287346091842342942

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 3 IoCs

pid	Process
2700	BootstrapperV1.23.exe
2108	bootstrapper.exe
1236	Process not Found

Loads dropped DLL 13 IoCs

pid	Process
3064	Bootstrapper.23.exe
2692	Process not Found
3064	Bootstrapper.23.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2544	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1076	WMIC.exe
Token: SeSecurityPrivilege	1076	WMIC.exe
Token: SeTakeOwnershipPrivilege	1076	WMIC.exe
Token: SeLoadDriverPrivilege	1076	WMIC.exe
Token: SeSystemProfilePrivilege	1076	WMIC.exe
Token: SeSystemtimePrivilege	1076	WMIC.exe
Token: SeProfSingleProcessPrivilege	1076	WMIC.exe
Token: SeIncBasePriorityPrivilege	1076	WMIC.exe
Token: SeCreatePagefilePrivilege	1076	WMIC.exe
Token: SeBackupPrivilege	1076	WMIC.exe
Token: SeRestorePrivilege	1076	WMIC.exe
Token: SeShutdownPrivilege	1076	WMIC.exe
Token: SeDebugPrivilege	1076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1076	WMIC.exe
Token: SeRemoteShutdownPrivilege	1076	WMIC.exe
Token: SeUndockPrivilege	1076	WMIC.exe
Token: SeManageVolumePrivilege	1076	WMIC.exe
Token: 33	1076	WMIC.exe
Token: 34	1076	WMIC.exe
Token: 35	1076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1076	WMIC.exe
Token: SeSecurityPrivilege	1076	WMIC.exe
Token: SeTakeOwnershipPrivilege	1076	WMIC.exe
Token: SeLoadDriverPrivilege	1076	WMIC.exe
Token: SeSystemProfilePrivilege	1076	WMIC.exe
Token: SeSystemtimePrivilege	1076	WMIC.exe
Token: SeProfSingleProcessPrivilege	1076	WMIC.exe
Token: SeIncBasePriorityPrivilege	1076	WMIC.exe
Token: SeCreatePagefilePrivilege	1076	WMIC.exe
Token: SeBackupPrivilege	1076	WMIC.exe
Token: SeRestorePrivilege	1076	WMIC.exe
Token: SeShutdownPrivilege	1076	WMIC.exe
Token: SeDebugPrivilege	1076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1076	WMIC.exe
Token: SeRemoteShutdownPrivilege	1076	WMIC.exe
Token: SeUndockPrivilege	1076	WMIC.exe
Token: SeManageVolumePrivilege	1076	WMIC.exe
Token: 33	1076	WMIC.exe
Token: 34	1076	WMIC.exe
Token: 35	1076	WMIC.exe
Token: SeDebugPrivilege	2700	BootstrapperV1.23.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2700	3064	Bootstrapper.23.exe	30
PID 3064 wrote to memory of 2700	3064	Bootstrapper.23.exe	30
PID 3064 wrote to memory of 2700	3064	Bootstrapper.23.exe	30
PID 3064 wrote to memory of 2108	3064	Bootstrapper.23.exe	32
PID 3064 wrote to memory of 2108	3064	Bootstrapper.23.exe	32
PID 3064 wrote to memory of 2108	3064	Bootstrapper.23.exe	32
PID 2700 wrote to memory of 2660	2700	BootstrapperV1.23.exe	33
PID 2700 wrote to memory of 2660	2700	BootstrapperV1.23.exe	33
PID 2700 wrote to memory of 2660	2700	BootstrapperV1.23.exe	33
PID 2660 wrote to memory of 2544	2660	cmd.exe	35
PID 2660 wrote to memory of 2544	2660	cmd.exe	35
PID 2660 wrote to memory of 2544	2660	cmd.exe	35
PID 2108 wrote to memory of 2612	2108	bootstrapper.exe	36
PID 2108 wrote to memory of 2612	2108	bootstrapper.exe	36
PID 2108 wrote to memory of 2612	2108	bootstrapper.exe	36
PID 2700 wrote to memory of 3008	2700	BootstrapperV1.23.exe	37
PID 2700 wrote to memory of 3008	2700	BootstrapperV1.23.exe	37
PID 2700 wrote to memory of 3008	2700	BootstrapperV1.23.exe	37
PID 3008 wrote to memory of 1076	3008	cmd.exe	39
PID 3008 wrote to memory of 1076	3008	cmd.exe	39
PID 3008 wrote to memory of 1076	3008	cmd.exe	39
PID 2700 wrote to memory of 2192	2700	BootstrapperV1.23.exe	41
PID 2700 wrote to memory of 2192	2700	BootstrapperV1.23.exe	41
PID 2700 wrote to memory of 2192	2700	BootstrapperV1.23.exe	41

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.23.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.23.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\cmd.exe
    "cmd" /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2544
- - C:\Windows\system32\cmd.exe
    "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2700 -s 1128
    3⤵
    - Loads dropped DLL
    PID:2192
- C:\Users\Admin\AppData\Local\Temp\bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\bootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2108 -s 600
    3⤵
    - Loads dropped DLL
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bootstrapper.exe

Filesize
86KB

MD5
df7d3cdaec61a64a6ed21d2589affbd5

SHA1
fb3f771b6cd28943623accf0297e017a2d6a299a

SHA256
e4f24a73140e7c65201f58a76bae9e4bf05d064cfd726d1a559cd509c79dec57

SHA512
651b5b73655a4f2a7fd343d3e1dc0aaf067584c481b16495af74201dcbf65530cfa5cb4d425c19103143a56a810e4b087301c41917b832f3bb16c51edc437d46

Download Submit
\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe

Filesize
800KB

MD5
02c70d9d6696950c198db93b7f6a835e

SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2

SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb

Download Submit
memory/2108-18-0x000000013F670000-0x000000013F68A000-memory.dmp

Filesize
104KB

Download
memory/2108-20-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp

Filesize
9.9MB

Download
memory/2108-21-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp

Filesize
9.9MB

Download
memory/2108-28-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp

Filesize
9.9MB

Download
memory/2700-17-0x000007FEF5DB3000-0x000007FEF5DB4000-memory.dmp

Filesize
4KB

Download
memory/2700-19-0x0000000000AC0000-0x0000000000B8E000-memory.dmp

Filesize
824KB

Download
memory/2700-29-0x000007FEF5DB3000-0x000007FEF5DB4000-memory.dmp

Filesize
4KB

Download