discordrat | abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e

Analysis

max time kernel
99s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe
Size

748KB
MD5

4a50c0fac7e7c8c8bab89a1968d24927
SHA1

8315b29f960059621c67b06ce85d8390df61ae53
SHA256

abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e
SHA512

d6916f0a844ba8301a24b602411d859e44dedac5077c589fe9ae205f52dddb40b49bced20d3de41abf4a9a979b6171ee1f6b1318b811e460ec615fe2fd875d8f
SSDEEP

12288:8yveQB/fTHIGaPkKEYzURNAwbAg8f0VXGxnB/OBBh+HqXkGDQv88:8uDXTIGaPhEYzUzA0q6XGxZOBlHQv88

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMzk1NDMyMzI3Mjc2NTQ1MA.GlwOtb.MRk2b9stGIOHJ31nrWHUdCWhTi5zASWKSorIOk
server_id
1323954995678417017

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe

Executes dropped EXE 1 IoCs

pid	Process
3604	backdoored.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
18	discord.com
19	discord.com
25	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	backdoored.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3604	1784	abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe	83
PID 1784 wrote to memory of 3604	1784	abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe	83

C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe
"C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe

Filesize
78KB

MD5
54e9187948f4a9b41bd59d9fd635eecc

SHA1
035ad8b616219217759da98bf1389cdbd9b61f5c

SHA256
bc2103c84955d2046cc1c8460f6ed28de8739cbb21143cae612c5b8ef31ea63e

SHA512
452be3bd85e93e005c406c0b9998c8c92e0ce6b38538d22d48a307f3496872a8a4d1542ee16c210cac5a0d86c391081c892ff657b2351a5c72b756241c1f58ea

Download Submit
memory/3604-16-0x00007FFEF0B43000-0x00007FFEF0B45000-memory.dmp

Filesize
8KB

Download
memory/3604-17-0x000001D0BE160000-0x000001D0BE178000-memory.dmp

Filesize
96KB

Download
memory/3604-18-0x000001D0D88C0000-0x000001D0D8A82000-memory.dmp

Filesize
1.8MB

Download
memory/3604-19-0x00007FFEF0B40000-0x00007FFEF1601000-memory.dmp

Filesize
10.8MB

Download
memory/3604-20-0x000001D0D9200000-0x000001D0D9728000-memory.dmp

Filesize
5.2MB

Download
memory/3604-21-0x00007FFEF0B43000-0x00007FFEF0B45000-memory.dmp

Filesize
8KB

Download
memory/3604-22-0x00007FFEF0B40000-0x00007FFEF1601000-memory.dmp

Filesize
10.8MB

Download