discordrat | 4828bdac5bb23ffcea7f6c51142e32157ac2ca80620d1e39b3170513e116b05e | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 18:20

Sharing

Report Analysis Logs

General

Target

olduimatrix.exe
Size

98KB
MD5

9117f3f95888ab5de9da24ab2965cc5a
SHA1

2df63c9abcf08e58bcc6fd3891cbf1be30ac1d6d
SHA256

4828bdac5bb23ffcea7f6c51142e32157ac2ca80620d1e39b3170513e116b05e
SHA512

18d02eb4de36d1c670a4eacdbbb269554b212a379013b17f2d990ea594ef1ec57e0b616985bc53f866dab051d5ce2499bea59340fc58f3d906c42082bcae0f36
SSDEEP

1536:92WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+DPISWlKKBh0NjD3C+GlEQ:9Zv5PDwbjNrmAE+bISTbDVGaQ

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM0MjkxNTYzNjA0NDYzMjE4MA.GLuN76.KEi91jZBbiW-Aa2A5gBlUy7tjno2DDMvendvrg
server_id
1342915521502384308

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2012	1696	olduimatrix.exe	31
PID 1696 wrote to memory of 2012	1696	olduimatrix.exe	31
PID 1696 wrote to memory of 2012	1696	olduimatrix.exe	31

C:\Users\Admin\AppData\Local\Temp\olduimatrix.exe
"C:\Users\Admin\AppData\Local\Temp\olduimatrix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1696 -s 600
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-0-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

Filesize
4KB

Download
memory/1696-1-0x000000013FBC0000-0x000000013FBDC000-memory.dmp

Filesize
112KB

Download
memory/1696-2-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/1696-3-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download