discordrat | 783d046079b0d891a7cceee54a03e292efd2eb5941e90a268a0a6331c9805d03 | Triage

Resubmissions

06-01-2025 21:59

250106-1wb9wazkay 10

06-01-2025 21:55

250106-1s9qzayrhx 10

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 21:59

Sharing

Report Analysis Logs

General

Target

Vbuck GEN.exe
Size

78KB
MD5

19bb02eb4df10edd6af6822a847263dc
SHA1

eef31717a1cedf4ad3628092f2cc0074ad9d5b8e
SHA256

783d046079b0d891a7cceee54a03e292efd2eb5941e90a268a0a6331c9805d03
SHA512

4d523d09af36bc0c24e68c9a093cc51ce44aca766ad228cac8706c34b506fcd438efc6a2d4f2dafde0872d78df0c34e64cfc8548742af913d1864c29562486e0
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyNTU1MjM5MjUxNDY5OTM4Ng.GSsXF0.2F-rPvyxUMTADJXbj04XJt8RzF459DH9mdIDiA
server_id
1325554226285379708

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2824	2884	Vbuck GEN.exe	30
PID 2884 wrote to memory of 2824	2884	Vbuck GEN.exe	30
PID 2884 wrote to memory of 2824	2884	Vbuck GEN.exe	30

C:\Users\Admin\AppData\Local\Temp\Vbuck GEN.exe
"C:\Users\Admin\AppData\Local\Temp\Vbuck GEN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2884 -s 604
  2⤵
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-0-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

Filesize
4KB

Download
memory/2884-1-0x000000013FDA0000-0x000000013FDB8000-memory.dmp

Filesize
96KB

Download
memory/2884-2-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2884-3-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download