discordrat | 2ecbb7bc7319ecdcb2d9d4bbf38deabd2a3a93999e02f595d9413bb4b9767171 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 04:46

Sharing

Report Analysis Logs

General

Target

virus/resources/Discord.exe
Size

78KB
MD5

4a65257ccc7cc5c6440dcefe5ad4523f
SHA1

0ee7ba38ed1f16cf4aaea11edb64e8275d674c10
SHA256

e82cec44f57277f6172f89f7107b46754e5d0f3aed3ce61c8dac13b258218dcf
SHA512

23839a073fcd6872edd105c7f8a8baca7dfa7c25f6f8c4e3e0c3f9da37862493c80825a5582c338d89fc08e35bc1fe9941b49cb7731b24f607e0fb06504b7449
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMzg2NTkxNDI4NjAxODY2NQ.GWEzhT.LfNT1TRxrNi0wH4g7-xuQFdnyioFM2jNkyqNMk
server_id
1323845201596387451

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2748	2632	Discord.exe	30
PID 2632 wrote to memory of 2748	2632	Discord.exe	30
PID 2632 wrote to memory of 2748	2632	Discord.exe	30

C:\Users\Admin\AppData\Local\Temp\virus\resources\Discord.exe
"C:\Users\Admin\AppData\Local\Temp\virus\resources\Discord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2632 -s 596
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2632-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/2632-1-0x000000013F030000-0x000000013F048000-memory.dmp

Filesize
96KB

Download
memory/2632-2-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2632-3-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download