Malware Analysis Report

2025-04-13 12:24

Sample ID 250102-b85draypdm
Target abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e
SHA256 abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e
Tags
discordrat persistence rat rootkit stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e

Threat Level: Known bad

The file abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e was found to be: Known bad.

Malicious Activity Summary

discordrat persistence rat rootkit stealer

Discord RAT

Discordrat family

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-02 01:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-02 01:49

Reported

2025-01-02 01:52

Platform

win7-20240903-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Discordrat family

discordrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe

"C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2868 -s 596

Network

N/A

Files

memory/2108-6-0x0000000003210000-0x0000000003220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe

MD5 54e9187948f4a9b41bd59d9fd635eecc
SHA1 035ad8b616219217759da98bf1389cdbd9b61f5c
SHA256 bc2103c84955d2046cc1c8460f6ed28de8739cbb21143cae612c5b8ef31ea63e
SHA512 452be3bd85e93e005c406c0b9998c8c92e0ce6b38538d22d48a307f3496872a8a4d1542ee16c210cac5a0d86c391081c892ff657b2351a5c72b756241c1f58ea

memory/2868-13-0x000007FEF5323000-0x000007FEF5324000-memory.dmp

memory/2868-14-0x000000013FFC0000-0x000000013FFD8000-memory.dmp

memory/2868-19-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

memory/2868-21-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-02 01:49

Reported

2025-01-02 01:52

Platform

win10v2004-20241007-en

Max time kernel

99s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Discordrat family

discordrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe

"C:\Users\Admin\AppData\Local\Temp\abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.134.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 234.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 geolocation-db.com udp
DE 159.89.102.253:443 geolocation-db.com tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 253.102.89.159.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoored.exe

MD5 54e9187948f4a9b41bd59d9fd635eecc
SHA1 035ad8b616219217759da98bf1389cdbd9b61f5c
SHA256 bc2103c84955d2046cc1c8460f6ed28de8739cbb21143cae612c5b8ef31ea63e
SHA512 452be3bd85e93e005c406c0b9998c8c92e0ce6b38538d22d48a307f3496872a8a4d1542ee16c210cac5a0d86c391081c892ff657b2351a5c72b756241c1f58ea

memory/3604-16-0x00007FFEF0B43000-0x00007FFEF0B45000-memory.dmp

memory/3604-17-0x000001D0BE160000-0x000001D0BE178000-memory.dmp

memory/3604-18-0x000001D0D88C0000-0x000001D0D8A82000-memory.dmp

memory/3604-19-0x00007FFEF0B40000-0x00007FFEF1601000-memory.dmp

memory/3604-20-0x000001D0D9200000-0x000001D0D9728000-memory.dmp

memory/3604-21-0x00007FFEF0B43000-0x00007FFEF0B45000-memory.dmp

memory/3604-22-0x00007FFEF0B40000-0x00007FFEF1601000-memory.dmp