discordrat | 9c538454c0d5bc061140f31eb10784e7f525f865dcdaa4b66aa689c1a85543b8 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-02-2025 17:13

Sharing

Report Analysis Logs

General

Target

Client-built1.exe
Size

78KB
MD5

c305efabf3779d300d766a4e2990f6cd
SHA1

febf6b16a6e3de42427fc0fbc2a1191acc66aaa8
SHA256

9c538454c0d5bc061140f31eb10784e7f525f865dcdaa4b66aa689c1a85543b8
SHA512

05653e94292a2aa95203857b6efb0cfe4d9562a6f94c8dce6d12063ad4e39021abc42fe5058b15a2906715b232388dca6e272f3336e915c70ded964454a850cc
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwODUzODYxNDg0MTM0NDAyMQ.GYcOVt.Gp_DOcHBox7P0N-zNBTm49eq6NTvt_N2AxMvF8
server_id
1336013454258995351

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 3040	1252	Client-built1.exe	30
PID 1252 wrote to memory of 3040	1252	Client-built1.exe	30
PID 1252 wrote to memory of 3040	1252	Client-built1.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built1.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1252 -s 600
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/1252-1-0x000000013FD50000-0x000000013FD68000-memory.dmp

Filesize
96KB

Download
memory/1252-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/1252-3-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download