discordrat | ab1f5565ec87d83344a85ea76310b4cd9f82877a9d39ff55977ca5f96f5324f4

Analysis

max time kernel
17s
max time network
51s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-01-2025 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BM4Refl_gpj.exe
Size

529KB
MD5

d7746b44fff33140ee35be0cf8635098
SHA1

93d8359ebee5849abddec1d66f13f867dcbab214
SHA256

ab1f5565ec87d83344a85ea76310b4cd9f82877a9d39ff55977ca5f96f5324f4
SHA512

befdb09a8f1b66c30c2f9eee5d75f0547f40f6d66e12e484aaaaebea6d5f09629e00b16afdd0e3f54bdada3a371f88dd24a54befdf5497a0c0cfe42128de5522
SSDEEP

12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4r/ts2w77PJh:xuDXTIGaPhEYzUzA0/0DDw77Rh

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMTk5NDk0MzgwMzQyODk3Nw.G7hRt0.tsvaJSgO9QCXFDWq0chKEu6Jsm3XDWEWHH41wA
server_id
1321995666821484655

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 1 IoCs

pid	Process
3440	Piercing-3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	Piercing-3.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 3440	1380	BM4Refl_gpj.exe	77
PID 1380 wrote to memory of 3440	1380	BM4Refl_gpj.exe	77

C:\Users\Admin\AppData\Local\Temp\BM4Refl_gpj.exe
"C:\Users\Admin\AppData\Local\Temp\BM4Refl_gpj.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe

Filesize
78KB

MD5
b7ccf7b812bb770c597725179857962f

SHA1
67ea478ef8c7f502576620821d85521197a5e533

SHA256
8438e6e9643604ca36f6d5196cbe4c417f61c69adf43ae2e8a991ce9ecacc005

SHA512
48b22d57758511e38b26e2404b4be03f2bc4050e4906a8f4f73bc2fd91efb4bfd9069effae2e7dc91843ed3c28751020db2e62335163f4e770400b94f40a0721

Download Submit
memory/3440-16-0x00007FFD5BC73000-0x00007FFD5BC75000-memory.dmp

Filesize
8KB

Download
memory/3440-17-0x000002098C660000-0x000002098C678000-memory.dmp

Filesize
96KB

Download
memory/3440-18-0x00000209A6D00000-0x00000209A6EC2000-memory.dmp

Filesize
1.8MB

Download
memory/3440-19-0x00007FFD5BC70000-0x00007FFD5C732000-memory.dmp

Filesize
10.8MB

Download
memory/3440-20-0x00000209A7FD0000-0x00000209A84F8000-memory.dmp

Filesize
5.2MB

Download
memory/3440-21-0x00007FFD5BC73000-0x00007FFD5BC75000-memory.dmp

Filesize
8KB

Download
memory/3440-22-0x00007FFD5BC70000-0x00007FFD5C732000-memory.dmp

Filesize
10.8MB

Download