discordrat | 247d661d487938ff1419584c1ffa411de89ff5dcb40053d7be51e321d7bddfad | Triage

Resubmissions

22-02-2025 09:45

250222-lq722atpbq 10

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 09:42

Sharing

Report Analysis Logs

General

Target

Slip.cc 2.exe
Size

78KB
MD5

c8253bce24fc725a44dd1d7d4bcb37d1
SHA1

63e19c75281583c4aaf6bc36a6ca2bca30ba558f
SHA256

247d661d487938ff1419584c1ffa411de89ff5dcb40053d7be51e321d7bddfad
SHA512

6cfc09b61da4cb88bce3bc7b2c8b5afd59901e660ea51348865df81af3f0d5c3271e2a37cef0f324d3186cc07b1f78e240d3e0b8c8c3ae677127710cce77fc63
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM0Mjc0MDk3MzQ4MjAxNjg0MA.GPkOp9.jLGDelzjPDXfKBCbh7KnYItZqub2qGH7OR9IQo
server_id
1342765305788629043

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2028	2068	Slip.cc 2.exe	30
PID 2068 wrote to memory of 2028	2068	Slip.cc 2.exe	30
PID 2068 wrote to memory of 2028	2068	Slip.cc 2.exe	30

C:\Users\Admin\AppData\Local\Temp\Slip.cc 2.exe
"C:\Users\Admin\AppData\Local\Temp\Slip.cc 2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2068 -s 596
  2⤵
  PID:2028

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x000007FEF5E83000-0x000007FEF5E84000-memory.dmp

Filesize
4KB

Download
memory/2068-1-0x000000013F350000-0x000000013F368000-memory.dmp

Filesize
96KB

Download
memory/2068-2-0x000007FEF5E80000-0x000007FEF686C000-memory.dmp

Filesize
9.9MB

Download
memory/2068-3-0x000007FEF5E80000-0x000007FEF686C000-memory.dmp

Filesize
9.9MB

Download