discordrat | 5d3e32eb5ea91429a749c4028fe649b9df47de27724dd42a487158ba50df6481 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 00:41

Sharing

Report Analysis Logs

General

Target

munchersmacroo.exe
Size

78KB
MD5

71bdc150dbeefcfcd1b666c9d6720c2d
SHA1

40bf65f8f3f769c38742100d78c207ad8216da8a
SHA256

5d3e32eb5ea91429a749c4028fe649b9df47de27724dd42a487158ba50df6481
SHA512

eb9c4b5ec98b88ef5c1d9c0e3c5c6aa0a980bedbcc018acccb7744bf13efd7b63dad90ac66c760483aed548b3bdb84371c3827b6dad251616c47aa330c3f26ad
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+2PIC:5Zv5PDwbjNrmAE+yIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzOTM5OTY3NjM5ODY2OTg1NQ.Gck5a5.XicI5CumuIGSMUtR_XyzAV131atN3kWG3NL6tM
server_id
1339399951423115286

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3068	1236	munchersmacroo.exe	30
PID 1236 wrote to memory of 3068	1236	munchersmacroo.exe	30
PID 1236 wrote to memory of 3068	1236	munchersmacroo.exe	30

C:\Users\Admin\AppData\Local\Temp\munchersmacroo.exe
"C:\Users\Admin\AppData\Local\Temp\munchersmacroo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1236 -s 600
  2⤵
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/1236-1-0x000000013F280000-0x000000013F298000-memory.dmp

Filesize
96KB

Download
memory/1236-2-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1236-3-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download