discordrat | 4f108611be452635e169bfb8849711088e6a3199d779563b9cdbe4fdc4b2cd09 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 22:39

Sharing

Report Analysis Logs

General

Target

spicypics.exe
Size

78KB
MD5

10e250b8f44c5ec38a51a856493e16b6
SHA1

513445d4e837225a27b3eaeb9c7965e517f3d9b8
SHA256

4f108611be452635e169bfb8849711088e6a3199d779563b9cdbe4fdc4b2cd09
SHA512

24b13f1080af4d38e6e9b7017fb94eb23fc6254505ada4a83178624c2a848c7cd1fde093c6a2dbe0af5b920003f108db5c3f0bbb5208262b738dd82058050cfd
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMTU4MjM2NDcyMzM4NDM1MQ.G-FuwN.gpQY1-Zqjvbb29Mt5kTMhmNWTBMnnzHCXU5EXA
server_id
1301657933876039711

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2256	1392	spicypics.exe	28
PID 1392 wrote to memory of 2256	1392	spicypics.exe	28
PID 1392 wrote to memory of 2256	1392	spicypics.exe	28

C:\Users\Admin\AppData\Local\Temp\spicypics.exe
"C:\Users\Admin\AppData\Local\Temp\spicypics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1392 -s 596
  2⤵
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/1392-1-0x000000013FC50000-0x000000013FC68000-memory.dmp

Filesize
96KB

Download
memory/1392-2-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1392-3-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download