discordrat | c7455fe26a34ee7e8c79a53c64ed60a18cdd53572b583e8bd1bd3aec77495b8f | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 14:41

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

b581b456a41a75eabf1b0c8d5164ab7e
SHA1

bcc8377b2d0f65cce2ca56579ed0bce487503b77
SHA256

c7455fe26a34ee7e8c79a53c64ed60a18cdd53572b583e8bd1bd3aec77495b8f
SHA512

eebd407bb15cb27fe961dd74f5107e1cdba82eb51bf93a1d5bac98d24efd08b32c288ce38a5c93dd67c80e4fce125c5033a628232b73e8cd706807072e9f2236
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNjc4NDY0ODg4MTE4MDc1Mg.GWtsRF.kK0NvOIppQRD_nL0qzrqtjoSvOfznpF5xqI5wg
server_id
1316784990255583242

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2148	2316	Client-built.exe	28
PID 2316 wrote to memory of 2148	2316	Client-built.exe	28
PID 2316 wrote to memory of 2148	2316	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2316 -s 596
  2⤵
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-0-0x000007FEF6363000-0x000007FEF6364000-memory.dmp

Filesize
4KB

Download
memory/2316-1-0x000000013F2C0000-0x000000013F2D8000-memory.dmp

Filesize
96KB

Download
memory/2316-2-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download
memory/2316-3-0x000007FEF6360000-0x000007FEF6D4C000-memory.dmp

Filesize
9.9MB

Download