discordrat | a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe
Size

545KB
MD5

4048ba7b33561ad82e221babd0dde0c1
SHA1

91a451f9082a99befae9e01410331e0607a2759f
SHA256

a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8
SHA512

029ec093da60658f5fbfe3026f3265e73c6d38cc2b7509d89a7f1d138aa042e6ecf308ad36fe84f8c75563da08537db58ab0e19a6306960309772de5c287e7c7
SSDEEP

12288:syveQB/fTHIGaPkKEYzURNAwbAg831KIiVkmeT5D3SaE:suDXTIGaPhEYzUzA0qFKJMD3SaE

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzMDYzMDE4NTEzMjg4NDAzOQ.GKdnEl.mme8TYp-zKiBazpkuwncKPoIlsQtVXLw9Vu4WY
server_id
1330630815956340776

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 1 IoCs

pid	Process
2736	BmwSpooferV2.4.1.exe

Loads dropped DLL 6 IoCs

pid	Process
2512	a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2736	2512	a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe	31
PID 2512 wrote to memory of 2736	2512	a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe	31
PID 2512 wrote to memory of 2736	2512	a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe	31
PID 2736 wrote to memory of 1056	2736	BmwSpooferV2.4.1.exe	32
PID 2736 wrote to memory of 1056	2736	BmwSpooferV2.4.1.exe	32
PID 2736 wrote to memory of 1056	2736	BmwSpooferV2.4.1.exe	32

C:\Users\Admin\AppData\Local\Temp\a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe
"C:\Users\Admin\AppData\Local\Temp\a7b0473b7206d519eb42eb0d4aa842041b4110fc5c90f999546b0cb91ebef8c8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BmwSpooferV2.4.1.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BmwSpooferV2.4.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2736 -s 600
    3⤵
    - Loads dropped DLL
    PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\BmwSpooferV2.4.1.exe

Filesize
78KB

MD5
a48d8bac27884e15820edd5788553011

SHA1
8a47506f977deb6964a29e1cf26029913b13a058

SHA256
d840fb32311552aef24fa0b404f570cb34ccbeb274a40c710d1cf1dc63b7a0a2

SHA512
fe009ceb484b5af352d686a6c4c3c3172156fce629e96666d7fef92d3b2864d4d6d798441c8ccc99e4b0fc2d944706b62edc2a00187e4aabe28895b276de2291

Download Submit
memory/2512-2-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2512-17-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2736-9-0x000007FEF5E53000-0x000007FEF5E54000-memory.dmp

Filesize
4KB

Download
memory/2736-10-0x000000013FB30000-0x000000013FB48000-memory.dmp

Filesize
96KB

Download
memory/2736-15-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-18-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download