discordrat | bd106b91048fc739e255f76dbd42f6c39a4ce22a1db5567adef95278b84b975f | Triage

Analysis

max time kernel
73s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 17:07

Sharing

Report Analysis Logs

General

Target

backdoor.exe
Size

78KB
MD5

fd20fe5621aa91f1ebac577a4b873694
SHA1

e21b19d3b71dafd57c64042553436d543852ed12
SHA256

bd106b91048fc739e255f76dbd42f6c39a4ce22a1db5567adef95278b84b975f
SHA512

c769fb3f55d937c9f536c3c201fd3158a4493ab70d03d659385f2537b779b3a1f18bff9be861157c1c1468fbec435d30608330327387eb7f674e26e8059cb8c3
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIC:5Zv5PDwbjNrmAE+VIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNzUyOTIxNDUyNTkwMjg4OA.GXalZP.lRGd6IoMrnd96ty8BDoTs4fndB5ZtDl8eCK_vU
server_id
1317529702952337458

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2224	2116	backdoor.exe	30
PID 2116 wrote to memory of 2224	2116	backdoor.exe	30
PID 2116 wrote to memory of 2224	2116	backdoor.exe	30

C:\Users\Admin\AppData\Local\Temp\backdoor.exe
"C:\Users\Admin\AppData\Local\Temp\backdoor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2116 -s 600
  2⤵
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x000000013F5C0000-0x000000013F5D8000-memory.dmp

Filesize
96KB

Download
memory/2116-2-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-3-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download