discordrat | 269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5.exe
Size

520KB
MD5

7e26d878b40e1e18d7a8502adb7786ee
SHA1

6ec71f9b6b4ed98c6ad17598cebfd2dbb2002355
SHA256

269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5
SHA512

c14613e37c3f7418ab289d92372677251d32663ac49d530d4f249014977e7d89dafd2f1b644dc2a4173d47e89e3b38d436da6a79425bcedb99736d7dee4d0ab6
SSDEEP

12288:EyveQB/fTHIGaPkKEYzURNAwbAg8jTYiGwbc:EuDXTIGaPhEYzUzA0qDGwbc

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMTM0MDQzMjc0Mjg3OTI3Mw.GMUugK._6Rg19IMHnSVA-dlu-NIekKS1NnRtnrMEh3n08
server_id
1321339493286019134

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5.exe

Executes dropped EXE 1 IoCs

pid	Process
2188	SteamUnlock.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	SteamUnlock.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2188	2184	269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5.exe	84
PID 2184 wrote to memory of 2188	2184	269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5.exe	84

C:\Users\Admin\AppData\Local\Temp\269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5.exe
"C:\Users\Admin\AppData\Local\Temp\269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\SteamUnlock.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SteamUnlock.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\SteamUnlock.exe

Filesize
78KB

MD5
5ffa997113e1c77bd1fe56b2a031da6c

SHA1
29eac5c9e7d61e318d6d251dece17f81a63fd22f

SHA256
63de0a9854e0d14b47230564d1aa3d04bb01f74fd5b986480ffe28dd1f224c9c

SHA512
62ee694c98f3b362cbf9c1ce0927d961bf360cb6ba6f34bab045c445fd0b8d3ca004476a43a8d20a54a1e2d6ecb9f7b1c4a142d0249a8e3e30b53540b50c42de

Download Submit
memory/2188-14-0x00007FFD35013000-0x00007FFD35015000-memory.dmp

Filesize
8KB

Download
memory/2188-15-0x000001940EA80000-0x000001940EA98000-memory.dmp

Filesize
96KB

Download
memory/2188-16-0x0000019429180000-0x0000019429342000-memory.dmp

Filesize
1.8MB

Download
memory/2188-17-0x00007FFD35010000-0x00007FFD35AD1000-memory.dmp

Filesize
10.8MB

Download
memory/2188-18-0x0000019429980000-0x0000019429EA8000-memory.dmp

Filesize
5.2MB

Download
memory/2188-19-0x00007FFD35010000-0x00007FFD35AD1000-memory.dmp

Filesize
10.8MB

Download