discordrat | f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/02/2025, 13:21

Sharing

Report Analysis Logs

General

Target

CARBOT BOT 2.0.exe
Size

78KB
MD5

f84e3c47d28a741b08c30c7a04c6ee00
SHA1

b45ae22bd44f7228b9c4a0242e65d2af6d2b7b76
SHA256

f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc
SHA512

fb62a0d8f8bf29316b0f3490f267df36248f2b8314ca39bab23b33824372a72460f8d62e4c1875388df6f3d5bdbe494f0a95ec90c9255b23f62a2c5f9d978967
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzODEzMzAzMTI4MTQ5NjA3NQ.G9nEy-.M7VwbXAvMLglPonGh0POraMB1SrrA8Sg01-xIg
server_id
1012892095574454333

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2688	2832	CARBOT BOT 2.0.exe	30
PID 2832 wrote to memory of 2688	2832	CARBOT BOT 2.0.exe	30
PID 2832 wrote to memory of 2688	2832	CARBOT BOT 2.0.exe	30

C:\Users\Admin\AppData\Local\Temp\CARBOT BOT 2.0.exe
"C:\Users\Admin\AppData\Local\Temp\CARBOT BOT 2.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2832 -s 596
  2⤵
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-0-0x000007FEF5933000-0x000007FEF5934000-memory.dmp

Filesize
4KB

Download
memory/2832-1-0x000000013FD20000-0x000000013FD38000-memory.dmp

Filesize
96KB

Download
memory/2832-2-0x000007FEF5930000-0x000007FEF631C000-memory.dmp

Filesize
9.9MB

Download
memory/2832-3-0x000007FEF5930000-0x000007FEF631C000-memory.dmp

Filesize
9.9MB

Download