discordrat | 23bb32996f7d5e1f33ab05600c29642956edc6b262304035efab73f3b86feec9 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 19:19

Sharing

Report Analysis Logs

General

Target

testpng.exe
Size

78KB
MD5

98f6e65be9a95b6a0ccf9a5aacf89de5
SHA1

6d4e66094d5e332457d62ed2b9910bc229240d58
SHA256

23bb32996f7d5e1f33ab05600c29642956edc6b262304035efab73f3b86feec9
SHA512

7f05f2dff4a20415ffcc9cd3c0fb2b74499aca9ab59f73817a66e68bcf74b9915c908f4b076abbf6083d4cd29d88e3c2e2f0cf855068b66e112444ec7949284e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ayPIC:5Zv5PDwbjNrmAE+a+IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNzE1MTMxMDMxMDY3NDQ1Mw.GmAoQR.n9xRqZURsT5g3LGTtKYNBSjio3XuQpmLH7RLO0
server_id
1317163923350487151

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2520	2316	testpng.exe	31
PID 2316 wrote to memory of 2520	2316	testpng.exe	31
PID 2316 wrote to memory of 2520	2316	testpng.exe	31

C:\Users\Admin\AppData\Local\Temp\testpng.exe
"C:\Users\Admin\AppData\Local\Temp\testpng.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2316 -s 596
  2⤵
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-0-0x000007FEF58D3000-0x000007FEF58D4000-memory.dmp

Filesize
4KB

Download
memory/2316-1-0x000000013FBB0000-0x000000013FBC8000-memory.dmp

Filesize
96KB

Download
memory/2316-2-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-3-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download