discordrat | 57324656a109baebb74108a425c78e8e5e7f6ebafc5bc3a80fc44d5b99254fde | Triage

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 18:00

Sharing

Report Analysis Logs

General

Target

TempSpoofer.exe
Size

78KB
MD5

358de6b4fccfc3039bfcf59625a3e222
SHA1

85ab66a8921277e1d0b1e0dbca3533271be3ad15
SHA256

57324656a109baebb74108a425c78e8e5e7f6ebafc5bc3a80fc44d5b99254fde
SHA512

deee1a31ca915e95a2d095351cbf446866e3c18e052a4b7f044c1f558ca1e98f6c1a9e7a8036a0170054cb83eb2600edd83cfcfaaf19fc426094b4f0fd3b3528
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+7PIC:5Zv5PDwbjNrmAE+zIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNTQ2NTY5MjY3MzQ3NDU5MQ.GPCiva.NkgczXS_PO9CFhqsuo2E4X4CaiS_1xP6NAtBb4
server_id
1315462772368085103

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2360	1604	TempSpoofer.exe	31
PID 1604 wrote to memory of 2360	1604	TempSpoofer.exe	31
PID 1604 wrote to memory of 2360	1604	TempSpoofer.exe	31

C:\Users\Admin\AppData\Local\Temp\TempSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\TempSpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1604 -s 600
  2⤵
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-0-0x000007FEF6313000-0x000007FEF6314000-memory.dmp

Filesize
4KB

Download
memory/1604-1-0x000000013F4F0000-0x000000013F508000-memory.dmp

Filesize
96KB

Download
memory/1604-2-0x000007FEF6310000-0x000007FEF6CFC000-memory.dmp

Filesize
9.9MB

Download
memory/1604-3-0x000007FEF6310000-0x000007FEF6CFC000-memory.dmp

Filesize
9.9MB

Download