discordrat | ee1c182db93ee31196e00430e72d13157cb87f8039f45811fe939990f80a64c2 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 22:21

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

fb552643b39d63cd82ad0120420d8867
SHA1

e3f5a60e2ac5cd2a9f7877f7aeecd46c8bfc0090
SHA256

ee1c182db93ee31196e00430e72d13157cb87f8039f45811fe939990f80a64c2
SHA512

217c67bda3b5a6e032a46167dd4c6937673023dc046982f81ba4369275e80f65b347fb467a91e0ae6d96d4ef083a599d98700c474cdc2bf3c325636e43f8c460
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMDgxOTMyMjE3NTg4NTMxMg.G2w9pl.M7X8vOnvAJ7kNogvMSqx8HdwxiyXxMyMuXon2w
server_id
1320816438822441184

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2416	2392	Client-built.exe	31
PID 2392 wrote to memory of 2416	2392	Client-built.exe	31
PID 2392 wrote to memory of 2416	2392	Client-built.exe	31

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 596
  2⤵
  PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-0-0x000007FEF60B3000-0x000007FEF60B4000-memory.dmp

Filesize
4KB

Download
memory/2392-1-0x000000013F0D0000-0x000000013F0E8000-memory.dmp

Filesize
96KB

Download
memory/2392-2-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2392-3-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download