discordrat | cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0

Analysis

max time kernel
7s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe
Size

588KB
MD5

1cc6d8b0062bd2cba1276ed67bf35c06
SHA1

f5fe59b1380d6d2b96d6abd92b27db0d19b92d17
SHA256

cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0
SHA512

22da4edd15adb6c73abcc15afe732b7423521cfb1dff1980258bcd7a11a9343a9dce248222d3fa280ae521f5e72beb13f2c19be91c9b54cc86124b006550ae6d
SSDEEP

12288:ayveQB/fTHIGaPkKEYzURNAwbAg8gGQL0mSCcjTIVWdHr7:auDXTIGaPhEYzUzA0qv40mU0VYHr7

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxODE4MTE0OTg3NjQyNDc3Nw.GQG8E9.nJeLLo161XgHRqOZobXXNSZwDQZ2I4osCosf_4
server_id
1318182170891911208

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe

Executes dropped EXE 1 IoCs

pid	Process
4484	uno.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
19	discord.com
20	discord.com
23	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	uno.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4484	3240	cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe	86
PID 3240 wrote to memory of 4484	3240	cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe	86

C:\Users\Admin\AppData\Local\Temp\cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe
"C:\Users\Admin\AppData\Local\Temp\cbeb080ac0d3c78fe7ee2d56249f46f3ff74e3c114337f6bc5557951e4c46bd0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\uno.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\uno.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\uno.exe

Filesize
78KB

MD5
450ecba1d1abd697740b513f1675d9b2

SHA1
985044a625d50042ca4d5829d93e2a3115278fd4

SHA256
665953beb4bf982b9f83d0f08953ade12a59504053b1c11b3672400cd26963ad

SHA512
47e20e979b1732ade07917126cd099ae538abf63d8bfada181705572d1e2dc492d99206aaacbddb31186da1cf5f306547a41bed205eeb1c6df6f0d53bb2db198

Download Submit
memory/4484-14-0x00007FFA99D03000-0x00007FFA99D05000-memory.dmp

Filesize
8KB

Download
memory/4484-15-0x000001A581C70000-0x000001A581C88000-memory.dmp

Filesize
96KB

Download
memory/4484-16-0x000001A59C2F0000-0x000001A59C4B2000-memory.dmp

Filesize
1.8MB

Download
memory/4484-17-0x00007FFA99D00000-0x00007FFA9A7C1000-memory.dmp

Filesize
10.8MB

Download
memory/4484-18-0x000001A59CAF0000-0x000001A59D018000-memory.dmp

Filesize
5.2MB

Download
memory/4484-19-0x00007FFA99D03000-0x00007FFA99D05000-memory.dmp

Filesize
8KB

Download
memory/4484-20-0x00007FFA99D00000-0x00007FFA9A7C1000-memory.dmp

Filesize
10.8MB

Download