discordrat | 6680f89c82be37c59e712a175db4f8d1396876b4b96783f758c03e3358a11001

Analysis

max time kernel
95s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test.exe
Size

478KB
MD5

b6c9cd772428fe9387ba4dcfe00edadf
SHA1

3b5ba4e507fb22da77729520f845954f8eec4866
SHA256

6680f89c82be37c59e712a175db4f8d1396876b4b96783f758c03e3358a11001
SHA512

05b9ecfac93e786736d1c3c46d445da05eed612884df8d4281048c82df33db73b283aa76baa7042e4b0aa872ed40bf3d1f00dbc99142e45b9b2dffca4b431339
SSDEEP

12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4UJm:xuDXTIGaPhEYzUzA0/0Em

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMTk5NDk0MzgwMzQyODk3Nw.G7hRt0.tsvaJSgO9QCXFDWq0chKEu6Jsm3XDWEWHH41wA
server_id
1321995666821484655

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Test.exe

Executes dropped EXE 1 IoCs

pid	Process
228	Piercing-3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	Test.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	Piercing-3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4072	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 228	3228	Test.exe	84
PID 3228 wrote to memory of 228	3228	Test.exe	84

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Piercing-3.exe

Filesize
78KB

MD5
b7ccf7b812bb770c597725179857962f

SHA1
67ea478ef8c7f502576620821d85521197a5e533

SHA256
8438e6e9643604ca36f6d5196cbe4c417f61c69adf43ae2e8a991ce9ecacc005

SHA512
48b22d57758511e38b26e2404b4be03f2bc4050e4906a8f4f73bc2fd91efb4bfd9069effae2e7dc91843ed3c28751020db2e62335163f4e770400b94f40a0721

Download Submit
memory/228-15-0x000002507E0B0000-0x000002507E0C8000-memory.dmp

Filesize
96KB

Download
memory/228-16-0x00000250800A0000-0x0000025080262000-memory.dmp

Filesize
1.8MB

Download
memory/228-17-0x0000025018F00000-0x0000025019428000-memory.dmp

Filesize
5.2MB

Download