discordrat | bc1a4130fb7cd74ec1d007a3a02077d62a044fffb0cf3da0facc9ffd6053c53b

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-02-2025 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

8703559c0b9c8c89320913a1c4c1ae4f
SHA1

d6ce08ff8c5b17417b7311ceb90c90915646694b
SHA256

bc1a4130fb7cd74ec1d007a3a02077d62a044fffb0cf3da0facc9ffd6053c53b
SHA512

5d921473b0319f2d2a7aa3fd0c066a2d948ae214156087e4c050896583662cdf5fb365ab18bccffa3d5f41ab6643a4090ad05d082c111262726e3a5e6b830df7
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzNjY5NTMzNTc5NTI5NDIxMA.Gcz8aM.S9GNOb8hb_K5jw1INx35qkuuY43bIbRdj8HWZQ
server_id
1336081242344390706

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	Client-built.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	MiniSearchHost.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
785073822344ae3813284ebc92bb596a

SHA1
96e2a933b38352ed2c8e6e34e94756b70c143214

SHA256
36ef4cbbc494deacf81f364b546281223a39bea01a32b0c4b0e2324f984d6817

SHA512
28b21e17fdf026a025503a2ae1014ea4e8ce5385e42396007a7a23aba3aecb591d225e2a90d47f6f9e02d34792d74b89547715d66899265dbf8372258ccf4498

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
327975ba2c226434c0009085b3702a06

SHA1
b7b8b25656b3caefad9c5a657f101f06e2024bbd

SHA256
6fa9064f304b70d6dcebee643ca017c2417ff325106917058f6e11341678583c

SHA512
150a57c143fc5ff2462f496f5a9451310b8d99e32c4d570641204c8062a78590f14bed438ac981e8b0609a0c87b859a1f8502a78687bc36c3a9529d633a58e51

Download Submit
memory/2776-0-0x00007FFCFF133000-0x00007FFCFF135000-memory.dmp

Filesize
8KB

Download
memory/2776-1-0x0000019A35710000-0x0000019A35728000-memory.dmp

Filesize
96KB

Download
memory/2776-2-0x0000019A4FDA0000-0x0000019A4FF62000-memory.dmp

Filesize
1.8MB

Download
memory/2776-3-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download
memory/2776-4-0x0000019A51020000-0x0000019A51548000-memory.dmp

Filesize
5.2MB

Download
memory/2776-23-0x00007FFCFF133000-0x00007FFCFF135000-memory.dmp

Filesize
8KB

Download
memory/2776-24-0x00007FFCFF130000-0x00007FFCFFBF2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads