discordrat | e81c03f063eb81973ecbc690961658b9d613e1648c3612fbc1ffdd41fbf1f7b3 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 13:22

Sharing

Report Analysis Logs

General

Target

Freerobux.exe
Size

78KB
MD5

224ffc7642433a54523e38d9bd28a7b4
SHA1

45ce3d4b4161a916b6c3c1126fe19bf1a0ce9490
SHA256

e81c03f063eb81973ecbc690961658b9d613e1648c3612fbc1ffdd41fbf1f7b3
SHA512

1960f6a2bb79f258c0e78d056caf7a384eff84bd50439eff68a85cdedab416d2623607cc98351d457b5f2cb1e89096ca99a06b8210ec749dc44f050427ae1eb3
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dPIC:5Zv5PDwbjNrmAE+NIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzNDc5OTg4Mjg4Nzg4ODk1OQ.GYogWp.NMtpgtuN4Hf6PsEomIL-OoyUKqRkEVtf5alRts
server_id
1334800372321222707

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2608	2840	Freerobux.exe	28
PID 2840 wrote to memory of 2608	2840	Freerobux.exe	28
PID 2840 wrote to memory of 2608	2840	Freerobux.exe	28

C:\Users\Admin\AppData\Local\Temp\Freerobux.exe
"C:\Users\Admin\AppData\Local\Temp\Freerobux.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2840 -s 596
  2⤵
  PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x000000013FE10000-0x000000013FE28000-memory.dmp

Filesize
96KB

Download
memory/2840-2-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2840-3-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download