discordrat | 125b32da71a719245f993ae15eb527602fc006a34150f1a62ca22aa09a4030be | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-02-2025 12:02

Sharing

Report Analysis Logs

General

Target

Napse.exe
Size

78KB
MD5

cfc722721aed1873e23116c5356b6912
SHA1

ac0d0eeada08d10cc09fae392c6999454f33c112
SHA256

125b32da71a719245f993ae15eb527602fc006a34150f1a62ca22aa09a4030be
SHA512

d0ed14e5114f136ace912d91c9d3433255a07c3ad2153cb4a01657dc3e0952ac2aecca36d3453516b586fad1022ecb292019f42b409a9d747127a7360f20f2da
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM0MDQ2NTE3NDQ5ODI0NjczOQ.GgpecB.kxRx8APhEc6BRQBnDkZtHIm-oDM9l7KM5H6-nA
server_id
1340466656878530610

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1752	2532	Napse.exe	30
PID 2532 wrote to memory of 1752	2532	Napse.exe	30
PID 2532 wrote to memory of 1752	2532	Napse.exe	30

C:\Users\Admin\AppData\Local\Temp\Napse.exe
"C:\Users\Admin\AppData\Local\Temp\Napse.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2532 -s 596
  2⤵
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x000007FEF5313000-0x000007FEF5314000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x000000013FD00000-0x000000013FD18000-memory.dmp

Filesize
96KB

Download
memory/2532-2-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/2532-3-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download