discordrat | 3fcfc7ed8a9fe616540b4e12926021b8ee515879f555a1e697961483bccb4fa5 | Triage

Resubmissions

03-02-2025 17:12

250203-vqyb9syqfp 10

01-02-2025 09:56

250201-lysx3sxjhz 10

01-02-2025 08:29

250201-kdnbesxlak 10

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 08:29

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

c5fe943c63dffbd58b0f61b70ce570e3
SHA1

1e0385df0eeb6078a04607866cdd0adf47646521
SHA256

3fcfc7ed8a9fe616540b4e12926021b8ee515879f555a1e697961483bccb4fa5
SHA512

b961ccb840443f5eb78fefa5417e22796f6e0b7272788b8fcdc6abd57262a1c2b4357050171a70af2b0e5d30a1849b081020f3498ab07e50aacbf9f60c32114b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzNDg2ODQ0OTQ4MjI0ODI1NA.GmvrOG.IWZ9BB6ZJ0i5ytcVVC-P4pzKCiMdbTruowhj90
server_id
1335159502953254943

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2700	2420	Client-built.exe	30
PID 2420 wrote to memory of 2700	2420	Client-built.exe	30
PID 2420 wrote to memory of 2700	2420	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 600
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x000007FEF5B33000-0x000007FEF5B34000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x000000013F030000-0x000000013F048000-memory.dmp

Filesize
96KB

Download
memory/2420-2-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download
memory/2420-3-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download