discordrat | 013fa3b832efcc8647331576e6f512b4101eb087d6155bbfc976d680e668a667 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/02/2025, 21:39

Sharing

Report Analysis Logs

General

Target

Crack perm spoofer.exe
Size

78KB
MD5

63ec2a8c348d255586762d693ddf98db
SHA1

b04dda431d28d76e205b528f74d10ffa69f3a960
SHA256

013fa3b832efcc8647331576e6f512b4101eb087d6155bbfc976d680e668a667
SHA512

e1f5f717770212241243f5cc166f7b89f6f89c0cdf2f442b56b8b5738e820a79a513fb9733a78451908c717961273acebc314a99f198cded5b425e878b4fbc88
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzNDYyNTQ5ODUxMjQ5NDYzNA.G0EGQj.I75TlNTsSnE4gYOgbUK9YInJj34V1hRalj4piM
server_id
1185260625232937030

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2240	1020	Crack perm spoofer.exe	30
PID 1020 wrote to memory of 2240	1020	Crack perm spoofer.exe	30
PID 1020 wrote to memory of 2240	1020	Crack perm spoofer.exe	30

C:\Users\Admin\AppData\Local\Temp\Crack perm spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Crack perm spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1020 -s 596
  2⤵
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download
memory/1020-1-0x000000013F820000-0x000000013F838000-memory.dmp

Filesize
96KB

Download
memory/1020-2-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/1020-3-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download