discordrat | 6320da463ff49f3b80eeb9b96a8bbfc71b430e4482b94d383fd3862490a5d13f | Triage

Resubmissions

16-12-2024 10:53

241216-mzgf4sylbj 10

16-12-2024 04:40

241216-fav5mswmej 10

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 04:40

Sharing

Report Analysis Logs

General

Target

AIMr.exe
Size

78KB
MD5

67e0e6dc1dab2b50e036948470c1bf5f
SHA1

f77d90748617aa516d95f06a6ef4fa511d9739fe
SHA256

07c46b658c76254d83cccd35b28ee12f948ec01b1e24b12eefe4d93752ddb8a1
SHA512

76b30103fa0612c11044543d5be4e36ad0340a3f1cdf91955e01911e886b427302dfa56972d9c9e554df8fbd30ae22b48293bd52241215df36a82022aea6959a
SSDEEP

1536:F2WjO8XeEXFd5P7v88wbjNrfxCXhRoKV6+V+rPIC:FZz5PDwbjNrmAE+DIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
ODgxNzQzODc5NTAwNTk5MzM3.Gz4jXn.nabvUjO4zX_jYK_mdMBrfdMRfCB5q240mJH-vo
server_id
1310387822045171713

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1608	2848	AIMr.exe	30
PID 2848 wrote to memory of 1608	2848	AIMr.exe	30
PID 2848 wrote to memory of 1608	2848	AIMr.exe	30

C:\Users\Admin\AppData\Local\Temp\AIMr.exe
"C:\Users\Admin\AppData\Local\Temp\AIMr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2848 -s 596
  2⤵
  PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2848-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/2848-1-0x000000013FC30000-0x000000013FC48000-memory.dmp

Filesize
96KB

Download
memory/2848-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2848-3-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download