discordrat | 073a3a554da262e3ffaced7bc3940c5ae2024cb0f457fe539df980326ac6acc2 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 14:17

Sharing

Report Analysis Logs

General

Target

Discord-Account-Generator-main/main.exe
Size

78KB
MD5

2dfd2fba1022292bcd1867b126624260
SHA1

ef374c3639e3f28a8594e1385a0f45a8e51f2673
SHA256

954bf7c432eac4d4291b76b598fe25f28275800eb9d06fe7f3f0b53b41f72c74
SHA512

1cd7427295950491b627945c4f848906e3ee710e593033ed24638b7e29ace004b7ae8d3cfc7726b3e1dea53595336ba165b1fd5282f8637b047a50217238c9fc
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+GnPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2MDQwNzQ1MjQyODUzMzgzMQ.GYv6Cs.bHorOgR3dzpv33F18dZaRpWKB43NnKIjozVcS8
server_id
1260407315073597510

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2728	2176	main.exe	30
PID 2176 wrote to memory of 2728	2176	main.exe	30
PID 2176 wrote to memory of 2728	2176	main.exe	30

C:\Users\Admin\AppData\Local\Temp\Discord-Account-Generator-main\main.exe
"C:\Users\Admin\AppData\Local\Temp\Discord-Account-Generator-main\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2176 -s 596
  2⤵
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x000000013F4C0000-0x000000013F4D8000-memory.dmp

Filesize
96KB

Download
memory/2176-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2176-3-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download