discordrat | 6680f89c82be37c59e712a175db4f8d1396876b4b96783f758c03e3358a11001

General

Target

Test.exe
Size

478KB
MD5

b6c9cd772428fe9387ba4dcfe00edadf
SHA1

3b5ba4e507fb22da77729520f845954f8eec4866
SHA256

6680f89c82be37c59e712a175db4f8d1396876b4b96783f758c03e3358a11001
SHA512

05b9ecfac93e786736d1c3c46d445da05eed612884df8d4281048c82df33db73b283aa76baa7042e4b0aa872ed40bf3d1f00dbc99142e45b9b2dffca4b431339
SSDEEP

12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4UJm:xuDXTIGaPhEYzUzA0/0Em

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMTk5NDk0MzgwMzQyODk3Nw.G7hRt0.tsvaJSgO9QCXFDWq0chKEu6Jsm3XDWEWHH41wA
server_id
1321995666821484655

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 1 IoCs

pid	Process
2672	Piercing-3.exe

Loads dropped DLL 6 IoCs

pid	Process
2380	Test.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2220	2380	Test.exe	30
PID 2380 wrote to memory of 2220	2380	Test.exe	30
PID 2380 wrote to memory of 2220	2380	Test.exe	30
PID 2220 wrote to memory of 2760	2220	rundll32.exe	31
PID 2220 wrote to memory of 2760	2220	rundll32.exe	31
PID 2220 wrote to memory of 2760	2220	rundll32.exe	31
PID 2220 wrote to memory of 2760	2220	rundll32.exe	31
PID 2380 wrote to memory of 2672	2380	Test.exe	32
PID 2380 wrote to memory of 2672	2380	Test.exe	32
PID 2380 wrote to memory of 2672	2380	Test.exe	32
PID 2672 wrote to memory of 2076	2672	Piercing-3.exe	33
PID 2672 wrote to memory of 2076	2672	Piercing-3.exe	33
PID 2672 wrote to memory of 2076	2672	Piercing-3.exe	33

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RarSFX0\AV_Bypass.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\AV_Bypass.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2760
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2672 -s 596
    3⤵
    - Loads dropped DLL
    PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\AV_Bypass.py

Filesize
6KB

MD5
a152b166fa53ed1efbac71133670f48c

SHA1
dc65a442414440ee7e23a0519335574d8b053f74

SHA256
bbef61d27046a8322ab9625ee0fe71c4ddfb298f8743248290ec6bbe1bf65025

SHA512
e3fc957510a6a1888d9547bf5d3205209e8c62a06cafe103d98d7eb2104151fdc0f982fff7dc38bdf7ad21ad39d49eec81722d75684c46b2e44c86883fe78fef

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
edbbd670581def401df8d7f42396ae64

SHA1
0f80be67aa7bd59d6b470a6df860ca4e86bd1d44

SHA256
672824de76df86492e35c5159de7bc4a7e54dfbf410118b4da8e13d73a48f033

SHA512
53279c4515bc32cb73dcd58b6b705264e7405b7a6e53515364bfb4cd9ea269a1022651ba1e73daac7f027c18b5287007e07c724d3d3fcb6d02f4d7e1376a13ec

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe

Filesize
78KB

MD5
b7ccf7b812bb770c597725179857962f

SHA1
67ea478ef8c7f502576620821d85521197a5e533

SHA256
8438e6e9643604ca36f6d5196cbe4c417f61c69adf43ae2e8a991ce9ecacc005

SHA512
48b22d57758511e38b26e2404b4be03f2bc4050e4906a8f4f73bc2fd91efb4bfd9069effae2e7dc91843ed3c28751020db2e62335163f4e770400b94f40a0721

Download Submit
memory/2672-10-0x000000013F160000-0x000000013F178000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing