Malware Analysis Report

2025-04-13 12:25

Sample ID 250103-ks7nlswnbx
Target 1324648543721361449-1324648543402725396-Imagen-loro_1
SHA256 c41c0a3aff41ec17de75cd8f31f268f5063693743eb4639c907042574b3724ca
Tags
discordrat persistence rat rootkit stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c41c0a3aff41ec17de75cd8f31f268f5063693743eb4639c907042574b3724ca

Threat Level: Known bad

The file 1324648543721361449-1324648543402725396-Imagen-loro_1 was found to be: Known bad.

Malicious Activity Summary

discordrat persistence rat rootkit stealer

Discord RAT

Discordrat family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-03 08:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-03 08:52

Reported

2025-01-03 08:55

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1324648543721361449-1324648543402725396-Imagen-loro_1.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Discordrat family

discordrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\1324648543721361449-1324648543402725396-Imagen-loro_1.exe

"C:\Users\Admin\AppData\Local\Temp\1324648543721361449-1324648543402725396-Imagen-loro_1.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2596 -s 596

Network

N/A

Files

memory/2676-4-0x0000000002490000-0x00000000024A0000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe

MD5 dfdb4e31afcca54bbd536d1ff9f378c3
SHA1 88f973a381b342cb4bfd0952cd4985d83f0032d1
SHA256 9faf3b2adc648c52ed8f3930475cd2e75b5b415d50fb1b5d865c3ef15c77fc02
SHA512 f26d29f9c7433e82bbb3e99b41581689e9b487ea0ed61ae663f65bc28b705a7c1051a766c405394ee0d4a056d3a02a0c84fdebb307ac232d765c7e710dfaf207

memory/2596-11-0x000007FEF4E13000-0x000007FEF4E14000-memory.dmp

memory/2596-12-0x000000013F890000-0x000000013F8A8000-memory.dmp

memory/2596-17-0x000007FEF4E10000-0x000007FEF57FC000-memory.dmp

memory/2596-19-0x000007FEF4E10000-0x000007FEF57FC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-03 08:52

Reported

2025-01-03 08:55

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1324648543721361449-1324648543402725396-Imagen-loro_1.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Discordrat family

discordrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1324648543721361449-1324648543402725396-Imagen-loro_1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1324648543721361449-1324648543402725396-Imagen-loro_1.exe

"C:\Users\Admin\AppData\Local\Temp\1324648543721361449-1324648543402725396-Imagen-loro_1.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.136.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 234.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 167.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe

MD5 dfdb4e31afcca54bbd536d1ff9f378c3
SHA1 88f973a381b342cb4bfd0952cd4985d83f0032d1
SHA256 9faf3b2adc648c52ed8f3930475cd2e75b5b415d50fb1b5d865c3ef15c77fc02
SHA512 f26d29f9c7433e82bbb3e99b41581689e9b487ea0ed61ae663f65bc28b705a7c1051a766c405394ee0d4a056d3a02a0c84fdebb307ac232d765c7e710dfaf207

memory/4756-14-0x00007FFD474F3000-0x00007FFD474F5000-memory.dmp

memory/4756-15-0x0000024ED4790000-0x0000024ED47A8000-memory.dmp

memory/4756-16-0x0000024EEEDB0000-0x0000024EEEF72000-memory.dmp

memory/4756-17-0x00007FFD474F0000-0x00007FFD47FB1000-memory.dmp

memory/4756-18-0x0000024EEF5B0000-0x0000024EEFAD8000-memory.dmp

memory/4756-19-0x00007FFD474F3000-0x00007FFD474F5000-memory.dmp

memory/4756-20-0x00007FFD474F0000-0x00007FFD47FB1000-memory.dmp