discordrat | caeea16149010bd02cbe3a054fcdd9fba47497f3e3e9c546e54c0785d2f8f04d

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-02-2025 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

skin1gnp.scr
Size

307KB
MD5

8f7810381f42d29134a4ac5087a92a42
SHA1

8eb837f7e26aa5c2b6ef5b18705f6f097f140bea
SHA256

caeea16149010bd02cbe3a054fcdd9fba47497f3e3e9c546e54c0785d2f8f04d
SHA512

0dd70d23abd2ccf1d70bb2b7e6062815da45c943cf95a5b48a695d546b9a2fa1dad3c8316c89aa8b1438f3c5bd2ed0489dc9a8303f3ef73137ec994838f7b7c2
SSDEEP

6144:dTouKrWBEu3/Z2lpGDHU3ykJkNb3T/IDDjkiAgHFh:dToPWBv/cpGrU3yJNb3jIYhQFh

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyMzkzMDI5MjY4Nzg2Mzg3OQ.GCQy-9.zSkHr2ex6TmqW70MMKmAeduFkI1B5WhgY-dPIw
server_id
1189610200676708393

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 1 IoCs

pid	Process
2660	skin1.exe

Loads dropped DLL 6 IoCs

pid	Process
2772	skin1gnp.scr
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skin1gnp.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	DllHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2756	DllHost.exe
2756	DllHost.exe
2756	DllHost.exe
2756	DllHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2660	2772	skin1gnp.scr	31
PID 2772 wrote to memory of 2660	2772	skin1gnp.scr	31
PID 2772 wrote to memory of 2660	2772	skin1gnp.scr	31
PID 2772 wrote to memory of 2660	2772	skin1gnp.scr	31
PID 2660 wrote to memory of 2656	2660	skin1.exe	32
PID 2660 wrote to memory of 2656	2660	skin1.exe	32
PID 2660 wrote to memory of 2656	2660	skin1.exe	32

C:\Users\Admin\AppData\Local\Temp\skin1gnp.scr
"C:\Users\Admin\AppData\Local\Temp\skin1gnp.scr" /S
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\skin1.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\skin1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2660 -s 596
    3⤵
    - Loads dropped DLL
    PID:2656

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\skin1.png

Filesize
954B

MD5
7684bd495d1de923641074c3d3269b1c

SHA1
caf4bcd7cfa9b00e56a693f6190303d49de9c107

SHA256
cf7919da4cfb75163e1f719b4677cb3d46f2e5dc21b810219d74a8130d4a6d70

SHA512
031fbfb19ecfac041c203dcc8f89216251be1f42da03f5f94d7e457ce3a4a1dacb1b7ce9d2f37dc1a7463f5e2902d58c5464b332a264328285b36f4e707cbc1a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\skin1.exe

Filesize
78KB

MD5
52036c9691f9ac816f428d14d7d9140c

SHA1
f6d327c687f80febb326d2074c00502d002879d3

SHA256
c2398be9e849c1af1c703d1cf65f48103ffca9c8e936c002dcf350f57f4c9d5a

SHA512
1aeb49acb382e5641011e30e1a51974cb5add0b6af1db2f1e8970304db2f49884e909f2beb10e4e93aaa2f0688d0bddd6761fe427189531f306fd0129fa32f18

Download Submit
memory/2660-13-0x000000013FBC0000-0x000000013FBD8000-memory.dmp

Filesize
96KB

Download
memory/2756-5-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download
memory/2756-6-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2756-20-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2772-4-0x00000000021D0000-0x00000000021D2000-memory.dmp

Filesize
8KB

Download