discordrat | 15c9db25ecf6db656246d23fd23cdcd328fbc7d59e4c13ef0aecb774674355ae | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 12:31

Sharing

Report Analysis Logs

General

Target

SperexUpdatev3.exe
Size

78KB
MD5

d7860cd78e5d8d084e3f5d341b4c983a
SHA1

58b029d709dc20b74b4a26b7fd28dc9cbdcc8105
SHA256

15c9db25ecf6db656246d23fd23cdcd328fbc7d59e4c13ef0aecb774674355ae
SHA512

3d9b876f32d63c8ea21fe2c5bf7d71d93b9401bdf39af85d17bbfe49609b2ca8af68dfcc6182ea0cc7691ba906c5d76913874fef156a48fb6d64c19c0637d0f5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+4PIC:5Zv5PDwbjNrmAE+cIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNzUyOTIxNDUyNTkwMjg4OA.G2AU-9.gp8oui8FZgS9lfAB_I_udCmnKXuah-v_04_U84
server_id
1317529702952337458

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1792	2016	SperexUpdatev3.exe	31
PID 2016 wrote to memory of 1792	2016	SperexUpdatev3.exe	31
PID 2016 wrote to memory of 1792	2016	SperexUpdatev3.exe	31

C:\Users\Admin\AppData\Local\Temp\SperexUpdatev3.exe
"C:\Users\Admin\AppData\Local\Temp\SperexUpdatev3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2016 -s 596
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download
memory/2016-1-0x000000013F900000-0x000000013F918000-memory.dmp

Filesize
96KB

Download
memory/2016-2-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/2016-3-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download