discordrat | 7bdb19204fec2ec0addc3761372caef85894bacf999c6c2fe80c64eef3abd936 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 23:30

Sharing

Report Analysis Logs

General

Target

Makala Executor/Makala Bootstrapper.exe
Size

78KB
MD5

6a7ea29ef2fb6c36471d0e055b81f084
SHA1

168ba0b3c3f51d89b4b3e5be7c91a813a51387c2
SHA256

cd562416060b65c4e342e62169e7d6136f7043e5252943b1a7033d9160ee383a
SHA512

f9ad092b14d16c13ddc1e791147efc2edfbe875865ee523bbb190ee851725ae3c909eabd15f9ad193d5cbedefa46802a886713cc471f0c2308e51fae61e9256e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxODM1MTU3NDYzNjAzNjEyNg.GOjBDm.fj5GQTX1yf12bG6cA-jFqOCZzVLbT2a7KZ8L7Y
server_id
1031700632450641981

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2044	1864	Makala Bootstrapper.exe	30
PID 1864 wrote to memory of 2044	1864	Makala Bootstrapper.exe	30
PID 1864 wrote to memory of 2044	1864	Makala Bootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\Makala Executor\Makala Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Makala Executor\Makala Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1864 -s 596
  2⤵
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/1864-1-0x000000013FC30000-0x000000013FC48000-memory.dmp

Filesize
96KB

Download
memory/1864-2-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/1864-3-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download