discordrat | d04ddf7952a16a431305356228eb710d73cbf6a3535c4c2def98777259b89995 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 07:05

Sharing

Report Analysis Logs

General

Target

FpsBooster.exe
Size

78KB
MD5

25c19f603ffbe06c31f0c14017cff05f
SHA1

95b910411947443e2b7bef6696d5cb7673c78401
SHA256

d04ddf7952a16a431305356228eb710d73cbf6a3535c4c2def98777259b89995
SHA512

157202c80833404183a715784b7029688b2d7ca1c737a63f05ddb2f60152056524ba5d8adf0e3c8f6c5f1ed697368c2634614eb881fd312f6d2aa71463c7bb4e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+otPIC:5Zv5PDwbjNrmAE+o9IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM0Mjc1MTA0NzE1MTUyMTgzMw.GXJuJH.GNID0FIbsbju6GvuIuoDaC6bdmP3OshwhGCrEY
server_id
1342750968311447554

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2504	1556	FpsBooster.exe	30
PID 1556 wrote to memory of 2504	1556	FpsBooster.exe	30
PID 1556 wrote to memory of 2504	1556	FpsBooster.exe	30

C:\Users\Admin\AppData\Local\Temp\FpsBooster.exe
"C:\Users\Admin\AppData\Local\Temp\FpsBooster.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1556 -s 600
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/1556-1-0x000000013FAD0000-0x000000013FAE8000-memory.dmp

Filesize
96KB

Download
memory/1556-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1556-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download