Analysis

  • max time kernel
    75s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/02/2025, 16:55 UTC

General

  • Target

    d7acea46b8e52588087f38b54d354b69d37e376c4c58c655ef6e0c2a6aaedd1e.exe

  • Size

    78KB

  • MD5

    9e4738a557e8bc2bf74a9918fb0deb52

  • SHA1

    60552388e129ef942f034a7b4d12094b72a3c76d

  • SHA256

    d7acea46b8e52588087f38b54d354b69d37e376c4c58c655ef6e0c2a6aaedd1e

  • SHA512

    60f8439a4bb534f78b2c495163b6fbce9593f1572cea84d7934992067f774aee0401c578c96cf3ac3957e4cab7ca4318632a19161d91f440f83b5a7edc250e7e

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dPICB:5Zv5PDwbjNrmAE+NICB

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMzNDg2ODQ0OTQ4MjI0ODI1NA.Gfn3Zp.JLsMt1DJyl2BRKGnfJyJCStA144I28izJVPav8

  • server_id

    1335159502953254943

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7acea46b8e52588087f38b54d354b69d37e376c4c58c655ef6e0c2a6aaedd1e.exe
    "C:\Users\Admin\AppData\Local\Temp\d7acea46b8e52588087f38b54d354b69d37e376c4c58c655ef6e0c2a6aaedd1e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1964 -s 604
      2⤵
        PID:2672

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1964-2-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

      Filesize

      9.9MB

    • memory/1964-1-0x000000013F7A0000-0x000000013F7B8000-memory.dmp

      Filesize

      96KB

    • memory/1964-0-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

      Filesize

      4KB

    • memory/1964-3-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

      Filesize

      9.9MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.