discordrat | b05da2ed4bd88840fb6470302387d8c16a004e5edee760294173f535c2d28457 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 02:14

Sharing

Report Analysis Logs

General

Target

BootstrapperADMINNEEDED.exe
Size

78KB
MD5

d19788cc20d3074c2650b0dd6e05ba9d
SHA1

1720a904a85ddbe91075f0581c4f45a1b208b351
SHA256

b05da2ed4bd88840fb6470302387d8c16a004e5edee760294173f535c2d28457
SHA512

0d62ae5a6cf1d40be1d29ffceb006149104313419e405ee894a6cc28808a80b2693c9ae7fbbd69b46f289eb7900300ef05f48eac94825bc300e40fba191705e5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM0MTMzNjU3MDY5OTA1OTIzNA.GukNj8._BVe7vm2rlnkoDaX41iJ8OkHeQ0RgF2c5fIFuY
server_id
1341023797532164179

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2700	2364	BootstrapperADMINNEEDED.exe	30
PID 2364 wrote to memory of 2700	2364	BootstrapperADMINNEEDED.exe	30
PID 2364 wrote to memory of 2700	2364	BootstrapperADMINNEEDED.exe	30

C:\Users\Admin\AppData\Local\Temp\BootstrapperADMINNEEDED.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperADMINNEEDED.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 600
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x000000013FC60000-0x000000013FC78000-memory.dmp

Filesize
96KB

Download
memory/2364-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-3-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download